Failover and recovery for replicated data instances

ABSTRACT

Replicated instances in a database environment provide for automatic failover and recovery. A monitoring component can periodically communicate with a primary and a secondary replica for an instance, with each capable of residing in a separate data zone or geographic location to provide a level of reliability and availability. A database running on the primary instance can have information synchronously replicated to the secondary replica at a block level, such that the primary and secondary replicas are in sync. In the event that the monitoring component is not able to communicate with one of the replicas, the monitoring component can attempt to determine whether those replicas can communicate with each other, as well as whether the replicas have the same data generation version. Depending on the state information, the monitoring component can automatically perform a recovery operation, such as to failover to the secondary replica or perform secondary replica recovery.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.15/083,210, filed Mar. 28, 2016, now U.S. Pat. No. 9,817,727, which is acontinuation of U.S. patent application Ser. No. 14/089,616, filed Nov.25, 2013, now U.S. Pat. No. 9,298,728, which is a continuation of, andclaims priority to, U.S. patent application Ser. No. 13/299,601,entitled “Failover and Recovery for Replicated Data Instances,” filedNov. 18, 2011, now U.S. Pat. No. 8,595,547, which is a continuation ofU.S. patent application Ser. No. 12/606,097, entitled “Failover andRecovery for Replicated Data Instances,” filed Oct. 26, 2009, now U.S.Pat. No. 8,074,107, the entire disclosure of each of which isincorporated herein by reference.

BACKGROUND

As an increasing number of applications and services are being madeavailable over networks such as the Internet, an increasing number ofcontent, application, and/or service providers are turning totechnologies such as cloud computing. Cloud computing, in general, is anapproach to providing access to electronic resources through services,such as Web services, where the hardware and/or software used to supportthose services is dynamically scalable to meet the needs of the servicesat any given time. A user or customer typically will rent, lease, orotherwise pay for access to resources through the cloud, and thus doesnot have to purchase and maintain the hardware and/or software toprovide access to these resources.

While aspects of various applications and resources can be adjusted andmanaged in the cloud, the data repositories upon which theseapplications and resources rely are not similarly adjustable or easilymanaged by a customer or other such user. Typically, performing taskssuch as provisioning and scaling data storage are tedious manualprocedures, in which a customer has to provide a database administrator(DBA) or similar expert user with configuration information andrequirements, such that the DBA can determine whether the configurationis valid. Further, there is no easy way for a customer to dynamicallyand/or automatically adjust the parameters for a database instance ormanage other such aspects of a data repository. In many cases, a datainstance will have backup and recovery mechanisms in place, but thesemechanisms often are in a single location or area such that they aresusceptible to failure or outages in that area. Further, when a datainstance fails, it typically takes a few minutes to generate a newinstance, attach the appropriate volumes to the new instance, andotherwise perform tasks necessary to recover from the failure.

BRIEF DESCRIPTION OF THE DRAWINGS

Various embodiments in accordance with the present disclosure will bedescribed with reference to the drawings, in which:

FIG. 1 illustrates an environment in which various embodiments can beimplemented;

FIG. 2 illustrates an example separation of a control plane and a dataplane that can be used in accordance with various embodiments;

FIG. 3 illustrates an example utilizing a plurality of monitoringcomponents that can be used in accordance with various embodiments;

FIG. 4 illustrates an example implementation for running a replicateddata instance across multiple data zones that can be used in accordancewith one embodiment;

FIG. 5 illustrates an example state transition diagram for a primaryreplica in accordance with one embodiment;

FIG. 6 illustrates an example state transition diagram for a monitoringcomponent in accordance with one embodiment;

FIG. 7 illustrates an example process for performing a failoveroperation that can be used in accordance with one embodiment;

FIG. 8 illustrates an example process for recovering a secondary replicathat can be used in accordance with one embodiment;

FIG. 9 illustrates an example process for managing event processors thatcan be used in accordance with one embodiment;

FIG. 10 illustrates an example of a reallocation due to a failed eventprocessor that can be used in accordance with one embodiment; and

FIG. 11 illustrates an example process for adding a new event processorthat can be used in accordance with one embodiment.

DETAILED DESCRIPTION

Systems and methods in accordance with various embodiments of thepresent disclosure may overcome one or more of the aforementioned andother deficiencies experienced in conventional approaches to managingaspects of data storage in an electronic environment. In particular,various embodiments provide a separate control environment, or controlplane, that can be used to enable a user to manage and/or alter variousaspects of a data environment, or data plane. This “self-service”functionality can be provided via a set of Web services, enabling theuser and control plane to act together as a virtual databaseadministrator (DBA). A user or customer can submit a request to thecontrol plane through one of a plurality of externally-visibleapplication programming interfaces (APIs), for example. Various APIs canbe used to perform specific functions with respect to a data repository,such as a relational database, in the data environment. A requestreceived to one of the APIs can be analyzed to determine the desiredaction(s) to be performed in the data plane, such as actions that adjustoperational or configuration parameters of a data store or data storageinstance. A component such as a workflow component can determine theappropriate tasks for the action, and cause the tasks to be executed inan appropriate order. At least one of these tasks typically will beperformed in the data environment, such as to adjust an aspect of arelational database.

In accordance with certain embodiments, such a system can provide forthe provisioning of a replicated data instance in the data environment.The provisioning can utilize a primary-secondary replication approach,with each of the primary and secondary replicas being provisioned in oracross one or more separate data zones, separate geographic locations,etc. The database replicas can run on separate data instances, eachattached to dedicated block storage volumes that are not shared acrossthe replicas.

In various embodiments, replication can be performed using a block-levelreplication mechanism, such as a Distributed Replicated Block Device(DRBD®) from Linbit of Vienna, Austria, or an Elastic Block Store (EBS),as provided by Amazon.com, Inc., of Seattle, Wash., which can mirror thecontent of block devices between servers and synchronously replicatedata across redundant systems. Each instance can run a kernel that has ablock-level replication mechanism (BLRM) kernel module installed formanaging all input and output (I/O) operations for the data instance.All reads and writes can be executed at a primary replica, with theblock-level replication mechanism replicating the informationsynchronously with the secondary replica.

Both the primary and secondary replicas can have an external facing DNSname. Customers can reach the current primary replica using a DNS namesuch as DNS_primary. The DNS_primary name can alias or “cname” to theexternal DNS name of the (current) primary replica. When a primaryreplica fails or is otherwise unavailable, the secondary replica can bepromoted or failed over to become the new primary replica, whereby thecname for DNS_primary can update to the DNS name of the new primaryinstance. All writes are sent to the database on the current primaryreplica. When the primary instance receives a write, the information issynchronously written to the secondary replica. Upon successful write atboth places, the write can be deemed successful. All reads also areexecuted only at the primary replica in various embodiments.

Database replication thus can be supported across multiple datainstances using instance replicas running in different data zones.Database writes can be committed using a synchronous replicationmechanism at the block level, such that no data is lost unless all thereplicas are unavailable due to a large scale outage involving multipledata zones, etc. Replication can provide higher availability than can beaccomplished using a single database instance, as a single replicafailure does not cause an outage to the database for an extended periodof time. For instance, if the primary replica of a database is down,various embodiments can perform a failover operation whereby a secondaryreplica takes over as the new primary replica. Replication also canprovide higher durability than a non-replicated database in manyinstances, protecting against failure of an data zone, data volumefailure, etc.

FIG. 1 illustrates an example of an environment 100 for implementingaspects in accordance with various embodiments. As will be appreciated,although a Web-based environment is used for purposes of explanation,different environments may be used, as appropriate, to implement variousembodiments. The environment 100 shown includes both a testing ordevelopment portion (or side) and a production portion. The productionportion includes an electronic client device 102, which can include anyappropriate device operable to send and receive requests, messages, orinformation over an appropriate network 104 and convey information backto a user of the device. Examples of such client devices includepersonal computers, cell phones, handheld messaging devices, laptopcomputers, set-top boxes, personal data assistants, electronic bookreaders, and the like. The network can include any appropriate network,including an intranet, the Internet, a cellular network, a local areanetwork, or any other such network or combination thereof. Componentsused for such a system can depend at least in part upon the type ofnetwork and/or environment selected. Protocols and components forcommunicating via such a network are well known and will not bediscussed herein in detail. Communication over the network can beenabled by wired or wireless connections, and combinations thereof. Inthis example, the network includes the Internet, as the environmentincludes a Web server 106 for receiving requests and serving content inresponse thereto, although for other networks an alternative deviceserving a similar purpose could be used as would be apparent to one ofordinary skill in the art.

The illustrative environment includes at least one application server108 and a data store 110. It should be understood that there can beseveral application servers, layers, or other elements, processes, orcomponents, which may be chained or otherwise configured, which caninteract to perform tasks such as obtaining data from an appropriatedata store. As used herein the term “data store” refers to any device orcombination of devices capable of storing, accessing, and retrievingdata, which may include any combination and number of data servers,databases, data storage devices, and data storage media, in anystandard, distributed, or clustered environment. The application servercan include any appropriate hardware and software for integrating withthe data store as needed to execute aspects of one or more applicationsfor the client device, handling a majority of the data access andbusiness logic for an application. The application server providesaccess control services in cooperation with the data store, and is ableto generate content such as text, graphics, audio, and/or video to betransferred to the user, which may be served to the user by the Webserver in the form of HTML, XML, or another appropriate structuredlanguage in this example. The handling of all requests and responses, aswell as the delivery of content between the client device 102 and theapplication server 108, can be handled by the Web server. It should beunderstood that the Web and application servers are not required and aremerely example components, as structured code discussed herein can beexecuted on any appropriate device or host machine as discussedelsewhere herein. Further, the environment can be architected in such away that a test automation framework can be provided as a service towhich a user or application can subscribe. A test automation frameworkcan be provided as an implementation of any of the various testingpatterns discussed herein, although various other implementations can beused as well, as discussed or suggested herein.

The environment also includes a development and/or testing side, whichincludes a user device 118 allowing a user such as a developer, dataadministrator, or tester to access the system. The user device 118 canbe any appropriate device or machine, such as is described above withrespect to the client device 102. The environment also includes adevelopment server 120, which functions similar to the applicationserver 108 but typically runs code during development and testing beforethe code is deployed and executed on the production side and isaccessible to outside users, for example. In some embodiments, anapplication server can function as a development server, and separateproduction and testing storage may not be used.

The data store 110 can include several separate data tables, databases,or other data storage mechanisms and media for storing data relating toa particular aspect. For example, the data store illustrated includesmechanisms for storing production data 112 and user information 116,which can be used to serve content for the production side. The datastore also is shown to include a mechanism for storing testing data 114,which can be used with the user information for the testing side. Itshould be understood that there can be many other aspects that may needto be stored in the data store, such as for page image information andaccess right information, which can be stored in any of the above listedmechanisms as appropriate or in additional mechanisms in the data store110. The data store 110 is operable, through logic associated therewith,to receive instructions from the application server 108 or developmentserver 120, and obtain, update, or otherwise process data in responsethereto. In one example, a user might submit a search request for acertain type of item. In this case, the data store might access the userinformation to verify the identity of the user, and can access thecatalog detail information to obtain information about items of thattype. The information then can be returned to the user, such as in aresults listing on a Web page that the user is able to view via abrowser on the user device 102. Information for a particular item ofinterest can be viewed in a dedicated page or window of the browser.

Each server typically will include an operating system that providesexecutable program instructions for the general administration andoperation of that server, and typically will include a computer-readablemedium storing instructions that, when executed by a processor of theserver, allow the server to perform its intended functions. Suitableimplementations for the operating system and general functionality ofthe servers are known or commercially available, and are readilyimplemented by persons having ordinary skill in the art, particularly inlight of the disclosure herein.

The environment in one embodiment is a distributed computing environmentutilizing several computer systems and components that areinterconnected via communication links, using one or more computernetworks or direct connections. However, it will be appreciated by thoseof ordinary skill in the art that such a system could operate equallywell in a system having fewer or a greater number of components than areillustrated in FIG. 1. Thus, the depiction of the system 100 in FIG. 1should be taken as being illustrative in nature, and not limiting to thescope of the disclosure.

An environment such as that illustrated in FIG. 1 can be useful for aprovider such as an electronic marketplace, wherein multiple hosts mightbe used to perform tasks such as serving content, authenticating users,performing payment transactions, or performing any of a number of othersuch tasks. Some of these hosts may be configured to offer the samefunctionality, while other servers might be configured to perform atleast some different functions. The electronic environment in such casesmight include additional components and/or other arrangements, such asthose illustrated in the configuration 200 of FIG. 2, discussed indetail below.

Systems and methods in accordance with one embodiment provide arelational database service (“RDS”) that enables developers, customers,or other authorized users to easily and cost-effectively obtain andconfigure relational databases and other such data sources so that userscan perform tasks such as storing, processing, and querying relationaldata sets in a cloud. While this example is discussed with respect tothe Internet, Web services, and Internet-based technology, it should beunderstood that aspects of the various embodiments can be used with anyappropriate services available or offered over a network in anelectronic environment. Further, while the service is referred to hereinas a “relational database service,” it should be understood that such aservice can be used with any appropriate type of data repository or datastorage in an electronic environment. An RDS in this example includes atleast one Web service that enables users or customers to easily managerelational data sets without worrying about the administrativecomplexities of deployment, upgrades, patch management, backups,replication, failover, capacity management, scaling, and other suchaspects of data management. Developers are thus freed to developsophisticated cloud applications without worrying about the complexitiesof managing the database infrastructure.

An RDS in one embodiment provides a separate “control plane” thatincludes components (e.g., hardware and software) useful for managingaspects of the data storage. In one embodiment, a set of data managementapplication programming interfaces (APIs) or other such interfaces areprovided that allow a user or customer to make calls into the RDS toperform certain tasks relating to the data storage. The user still canuse the direct interfaces or APIs to communicate with the datarepositories, however, and can use the RDS-specific APIs of the controlplane only when necessary to manage the data storage or perform asimilar task.

FIG. 2 illustrates an example of an RDS implementation 200 that can beused in accordance with one embodiment. In this example, a computingdevice 202 for an end user is shown to be able to make calls through anetwork 206 into a control plane 208 to perform a task such as toprovision a data repository of the data plane 210. The user or anapplication 204 can access the provisioned repository directly throughan interface of a data plane 210. While an end user computing device andapplication are used for purposes of explanation, it should beunderstood that any appropriate user, application, service, device,component, or resource can access the interface(s) of the control planeand/or data plane as appropriate in the various embodiments. Further,while the components are separated into control and data “planes,” itshould be understood that this can refer to an actual or virtualseparation of at least some resources (e.g., hardware and/or software)used to provide the respective functionality.

The control plane 208 in this example is essentially a virtual layer ofhardware and software components that handles control and managementactions, such as provisioning, scaling, replication, etc. The controlplane in this embodiment includes a Web services layer 212, or tier,which can include at least one Web server, for example, along withcomputer-executable software, application servers, or other suchcomponents. The Web services layer also can include a set of APIs 232(or other such interfaces) for receiving Web services calls or requestsfrom across the network 206. Each API can be provided to receiverequests for at least one specific action to be performed with respectto the data environment, such as to provision, scale, clone, orhibernate an instance of a relational database. Upon receiving a requestto one of the APIs, the Web services layer can parse or otherwiseanalyze the request to determine the steps or actions needed to act onor process the call. For example, a Web service call might be receivedthat includes a request to create a data repository. In this example,the Web services layer can parse the request to determine the type ofdata repository to be created, the storage volume requested, the type ofhardware requested (if any), or other such aspects. Information for therequest can be written to an administration (“Admin”) data store 222, orother appropriate storage location or job queue, for subsequentprocessing.

A Web service layer in one embodiment includes a scalable set ofcustomer-facing servers that can provide the various control plane APIsand return the appropriate responses based on the API specifications.The Web service layer also can include at least one API service layerthat in one embodiment consists of stateless, replicated servers whichprocess the externally-facing customer APIs. The Web service layer canbe responsible for Web service front end features such as authenticatingcustomers based on credentials, authorizing the customer, throttlingcustomer requests to the API servers, validating user input, andmarshalling or unmarshalling requests and responses. The API layer alsocan be responsible for reading and writing database configuration datato/from the administration data store, in response to the API calls. Inmany embodiments, the Web services layer and/or API service layer willbe the only externally visible component, or the only component that isvisible to, and accessible by, customers of the control service. Theservers of the Web services layer can be stateless and scaledhorizontally as known in the art. API servers, as well as the persistentdata store, can be spread across multiple data centers in a geographicalregion, or near a geographical location, for example, such that theservers are resilient to single data center failures.

The control plane in this embodiment includes what is referred to hereinas a “sweeper” component 214. A sweeper component can be any appropriatecomponent operable to poll various components of the control plane orotherwise determine any tasks to be executed in response to anoutstanding request. In this example, the Web services layer might placeinstructions or information for the “create database” request in theadmin data store 222, or a similar job queue, and the sweeper canperiodically check the admin data store for outstanding jobs. Variousother approaches can be used as would be apparent to one of ordinaryskill in the art, such as the Web services layer sending a notificationto a sweeper that a job exists. The sweeper component can pick up the“create database” request, and using information for the request cansend a request, call, or other such command to a workflow component 216operable to instantiate at least one workflow for the request. Theworkflow in one embodiment is generated and maintained using a workflowservice as is discussed elsewhere herein. A workflow in general is asequence of tasks that should be executed to perform a specific job. Theworkflow is not the actual work, but an abstraction of the work thatcontrols the flow of information and execution of the work. A workflowalso can be thought of as a state machine, which can manage and returnthe state of a process at any time during execution. A workflowcomponent (or system of components) in one embodiment is operable tomanage and/or perform the hosting and executing of workflows for taskssuch as: repository creation, modification, and deletion; recovery andbackup; security group creation, deletion, and modification; usercredentials management; and key rotation and credential management. Suchworkflows can be implemented on top of a workflow service, as discussedelsewhere herein. The workflow component also can manage differencesbetween workflow steps used for different database engines, such asMySQL, as the underlying workflow service does not necessarily change.

In this example, a workflow can be instantiated using a workflowtemplate for creating a database and applying information extracted fromthe original request. For example, if the request is for a MySQL®Relational Database Management System (RDBMS) instance, as opposed to anOracle® RDBMS or other such instance, then a specific task will be addedto the workflow that is directed toward MySQL instances. The workflowcomponent also can select specific tasks related to the amount ofstorage requested, any specific hardware requirements, or other suchtasks. These tasks can be added to the workflow in an order of executionuseful for the overall job. While some tasks can be performed inparallel, other tasks rely on previous tasks to be completed first. Theworkflow component or service can include this information in theworkflow, and the tasks can be executed and information passed asneeded.

An example “create database” workflow for a customer might includestasks such as provisioning a data store instance, allocating a volume ofoff-instance persistent storage, attaching the persistent storage volumeto the data store instance, then allocating and attaching a DNS addressor other address, port, interface, or identifier which the customer canuse to access or otherwise connect to the data instance. In thisexample, a user is provided with the DNS address and a port address tobe used to access the instance. The workflow also can include tasks todownload and install any binaries or other information used for thespecific data storage technology (e.g., MySQL). The workflow componentcan manage the execution of these and any related tasks, or any otherappropriate combination of such tasks, and can generate a response tothe request indicating the creation of a “database” in response to the“create database” request, which actually corresponds to a data storeinstance in the data plane 210, and provide the DNS address to be usedto access the instance. A user then can access the data store instancedirectly using the DNS address and port, without having to access or gothrough the control plane 208. Various other workflow templates can beused to perform similar jobs, such as deleting, creating, or modifyingone of more data store instances, such as to increase storage. In someembodiments, the workflow information is written to storage, and atleast one separate execution component (not shown) pulls or otherwiseaccesses or receives tasks to be executed based upon the workflowinformation. For example, there might be a dedicated provisioningcomponent that executes provisioning tasks, and this component might notbe called by the workflow component, but can monitor a task queue or canreceive information for a provisioning task in any of a number ofrelated ways as should be apparent.

As mentioned, various embodiments can take advantage of a workflowservice that can receive requests or calls for a current state of aprocess or task, such as the provisioning of a repository, and canreturn the current state of the process. The workflow component and/orworkflow service do not make the actual calls or requests to performeach task, but instead manage the state and configuration informationfor the workflow that enables the components of the control plane todetermine the next task to be performed, and any information needed forthat task, then generate the appropriate call(s) into the data planeincluding that state information, whereby a component of the data planecan make the call to perform the task. Workflows and tasks can bescheduled in parallel in order to increase throughput and maximizeprocessing resources. As discussed, the actual performing of the taskswill occur in the data plane, but the tasks will originate from thecontrol plane. For example, the workflow component can communicate witha host manager, which can make calls into the data store. Thus, for agiven task a call could be made to the workflow service passing certainparameters, whereby the workflow service generates the sequence of tasksfor the workflow and provides the current state, such that a task forthe present state can be performed. After the task is performed (orotherwise resolved or concluded), a component such as the host managercan reply to the service, which can then provide information about thenext state in the workflow, such that the next task can be performed.Each time one of the tasks for the workflow is performed, the servicecan provide a new task to be performed until the workflow is completed.Further, multiple threads can be running in parallel for differentworkflows to accelerate the processing of the workflow.

The control plane 208 in this embodiment also includes at least onemonitoring component 218. When a data instance is created in the dataplane, information for the instance can be written to a data store inthe control plane, such as a monitoring data store 220. It should beunderstood that the monitoring data store can be a separate data store,or can be a portion of another data store such as a distinct set oftables in an Admin data store 222, or other appropriate repository. Amonitoring component can access the information in the monitoring datastore to determine active instances 234 in the data plane 210. Amonitoring component also can perform other tasks, such as collectinglog and/or event information from multiple components of the controlplane and/or data plane, such as the Web service layer, workflowcomponent, sweeper component, and various host managers. Using suchevent information, the monitoring component can expose customer-visibleevents, for purposes such as implementing customer-facing APIs. Amonitoring component can constantly monitor the health of all therunning repositories and/or instances for the control plane, detect thefailure of any of these instances, and initiate the appropriate recoveryprocess(es).

Each instance 234 in the data plane can include at least one data store226 and a host manager component 228 for the machine providing access tothe data store. A host manager in one embodiment is an application orsoftware agent executing on an instance and/or application server, suchas a Tomcat or Java application server, programmed to manage tasks suchas software deployment and data store operations, as well as monitoringa state of the data store and/or the respective instance. A host managerin one embodiment listens on a port that can only be reached from theinternal system components, and is not available to customers or otheroutside entities. In some embodiments, the host manager cannot initiateany calls into the control plane layer. A host manager can beresponsible for managing and/or performing tasks such as setting up theinstances for a new repository, including setting up logical volumes andfile systems, installing database binaries and seeds, and starting orstopping the repository. A host manager can monitor the health of thedata store, as well as monitoring the data store for error conditionssuch as I/O errors or data storage errors, and can restart the datastore if necessary. A host manager also perform and/or mange theinstallation of software patches and upgrades for the data store and/oroperating system. A host manger also can collect relevant metrics, suchas may relate to CPU, memory, and I/O usage.

The monitoring component can communicate periodically with each hostmanager 228 for monitored instances 234, such as by sending a specificrequest or by monitoring heartbeats from the host managers, to determinea status of each host. In one embodiment, the monitoring componentincludes a set of event processors (or monitoring servers) configured toissue commands to each host manager, such as to get the status of aparticular host and/or instance. If a response is not received after aspecified number of retries, then the monitoring component can determinethat there is a problem and can store information in the Admin datastore 222 or another such job queue to perform an action for theinstance, such as to verify the problem and re-provision the instance ifnecessary. The sweeper can access this information and kick off arecovery workflow for the instance to attempt to automatically recoverfrom the failure. The host manager 228 can act as a proxy for themonitoring and other components of the control plane, performing tasksfor the instances on behalf of the control plane components.Occasionally, a problem will occur with one of the instances, such asthe corresponding host, instance, or volume crashing, rebooting,restarting, etc., which cannot be solved automatically. In oneembodiment, there is a logging component (not shown) that can log theseand other customer visibility events. The logging component can includean API or other such interface such that if an instance is unavailablefor a period of time, a customer can call an appropriate “events” orsimilar API to get the information regarding the event. In some cases, arequest may be left pending when an instance fails. Since the controlplane in this embodiment is separate from the data plane, the controlplane never receives the data request and thus cannot queue the requestfor subsequent submission (although in some embodiments this informationcould be forwarded to the control plane). Thus, the control plane inthis embodiment provides information to the user regarding the failureso the user can handle the request as necessary.

As discussed, once an instance is provisioned and a user is providedwith a DNS address or other address or location, the user can sendrequests “directly” to the data plane 210 through the network using aJava Database Connectivity (JDBC) or other such client to directlyinteract with that instance 234. In one embodiment, the data plane takesthe form of (or at least includes or is part of) a computing cloudenvironment, or a set of Web services and resources that provides datastorage and access across a “cloud” or dynamic network of hardwareand/or software components. A DNS address is beneficial in such adynamic cloud environment, as instance or availability failures, forexample, can be masked by programmatically remapping a DNS address toany appropriate replacement instance for a use. A request received froma user 202 or application 204, for example, can be directed to a networkaddress translation (NAT) router 224, or other appropriate component,which can direct the request to the actual instance 234 or hostcorresponding to the DNS of the request. As discussed, such an approachallows for instances to be dynamically moved, updated, replicated, etc.,without requiring the user or application to change the DNS or otheraddress used to access the instance. As discussed, each instance 234 caninclude a host manager 228 and a data store 226, and can have at leastone backup instance or copy in persistent storage 230. Using such anapproach, once the instance has been configured through the controlplane, a user, application, service, or component can interact with theinstance directly through requests to the data plane, without having toaccess the control plane 232. For example, the user can directly issuestructured query language (SQL) or other such commands relating to thedata in the instance through the DNS address. The user would only haveto access the control plane if the user wants to perform a task such asexpanding the storage capacity of an instance. In at least oneembodiment, the functionality of the control plane 208 can be offered asat least one service by a provider that may or may not be related to aprovider of the data plane 210, but may simply be a third-party servicethat can be used to provision and manage data instances in the dataplane, and can also monitor and ensure availability of those instancesin a separate data plane 210.

As discussed, one advantage to providing the functionality of a controlplane as a Web service or other such service is that the control planefunctions as a virtual database administrator (DBA) and avoids the needfor a human DBA to perform tasks such as provisioning data. Provisioningdata is presently a tedious manual procedure, requiring a DBA to receivethe necessary configuration information, determine whether theconfiguration is valid, optimize and tune the instance, and performother such tasks, which take a significant amount of time and effort.Further, such an approach provides many opportunities for error, whichmight not be discovered until after data is lost. Using a control planeor service as described herein, a user or customer can instead submit acall including information such as a type of hardware and a version of adatabase product. The control plane or service can then perform thenecessary tasks to create, delete, modify, expand, or otherwise modify adata store or data storage instance. The control plane also can supportseveral different database engines in a consistent fashion, withoutrequiring a DBA to be an expert in each of the engines. Onceprovisioned, the user has native access to the data instance(s), and cansimply point existing applications (such as MySQL applications) to theDNS address or other location information for the particular instance.There is no restriction or modification of query models or other suchfunctionality, as a user can continue to use applications built onMySQL, Oracle, or other database technology.

FIG. 3 illustrates an example of a configuration 300 that can be usedfor purposes such as monitoring and automated recovery of RDS instances,either single or replicated, in accordance with one embodiment. Althoughreference numbers are carried over between figures for purposes ofsimplicity and clarity, it should be understood that these merelyrepresent similar components that can be used for various embodiments,and should not be interpreted as requiring components from various otherembodiments or as merely showing different views of a single embodiment.Further, fewer or additional components can be used in variousembodiments, and the presence or lack of a component in a given figureshould not be interpreted as that component being required or not usefulin a given embodiment unless otherwise specifically stated. Variationsbetween the embodiments and figures should be apparent to one ofordinary skill in light of the present disclosure.

As illustrated in the figure, a monitoring component (or service) 218 ofthe control plane can comprise a series of processing nodes 302,referred to herein as event processors. In one embodiment, the eventprocessors comprise a fleet of monitoring servers operable to monitoraspects of the data plane. Each event processor can be configured tocommunicate with a specified set or range of data stores 226 and/or datainstances 234 through the associated host manager 228. As discussed,each data store and host manager can exist on a node or machine of thedata plane 210, or data environment. Each of the event processors cancommunicate with the allocated host managers using any appropriatecommunication technique to obtain a current status from each host, suchas by pinging each host manager using a secure (e.g., HTTPS) request,such as a “getStatus” request. In response to the request, each hostmanager can send a response including information such as whether thereis a problem with, or detected by, the host manager 228, as well as anyrelevant metrics, parameter values, or diagnostic information that isdetermined to be relevant. In certain embodiments, the amount and typeof information returned by a host manager can vary based upon a state ofthe host manager. For example, if there are no errors detected then thehost manager might send a standard set of specified metrics to be loggedor otherwise processed. If a problem is detected, for example, then adifferent set of information might be included, such as informationindicating the type of problem as well as diagnostic or otherinformation relevant to that type of problem. Various algorithms can beprovided to the host managers for making such determinations. Uponreceiving the information from the host managers, the event processorscan analyze the information, as necessary, and store the information ina monitoring data store 220 or other such location. The event processorscan also store any log information, discussed elsewhere herein, in themonitoring data store. As illustrated in this example, the monitoringdata store 220 can be a single logical data store, but can bepartitioned across many data instances 304.

There can be many advantages to using multiple event processors 302 aspart of the monitoring component 218. One such advantage is that, for alarge number of data instances 234 in the data plane, a single eventprocessor may not have enough capacity to monitor each instanceconcurrently. Utilizing multiple event processors allows the monitoringwork to the distributed across several event processors. Further, usingmultiple event processors allows for existing event processors to takeon the work of another event processor in the event of a failure orother such problem. If a data instance was only managed by a singleevent processor, and there was a problem with that processor making theevent processor unavailable, then that data instance might not have anymonitoring performed and thus could risk an outage or other suchproblem. By spreading the monitoring across a set of event processors,and allowing the range of monitoring by each event processor to updatedynamically, the control plane can ensure that each instance in the dataplane is monitored at substantially any time, even in the event of afailure of one or more of the event processors.

In one embodiment, the responsibility of each event processor isdetermined by taking the number of instances (including replicas) to bemonitored at any given time and apportioning the number of instancesacross the number of event processors. For example, if there are 25,000instances to be monitored in the data plane, and there are five eventprocessors running in the control plane, then each event processor canbe given responsibility for monitoring approximately 5,000 of the datainstances. If each instance is given an identifier, for example, theneach event processor can be given a range of identifiers (such as thefirst 5,000 identifiers, second 5,000 identifiers, etc.) to make iteasier to adjust responsibility for each event processor, rather thanhaving to manage mapping information for each of the 25,000 instances.The example in the figure shows the range of responsibilities for eachof the event processors in such an example.

At an appropriate interval, such as once a minute, each event processor302 can send a request to each host manager 228 being monitored by thatevent processor. An event processor in one embodiment is a Javaapplication running within a Tomcat container of the control plane thatregularly polls the host managers for data instances in the data plane.The event processor can poll a host manager in one embodiment by makinga getStatus( ) or similar call (e.g., over SSL) using the DNS name andhost manager port. In some embodiments a data instance being monitoredis uniquely identified by a combination of a customer data storeidentifier, a data store identifier, and an instance identifier. Usingsuch an approach, the states of the old and new instances can bedistinguished when moving a data instance to another instance in thecloud. The event processor can determine the state of the data instancebased upon the response from of the host manager. A data instance in oneembodiment can be in one of at least the following example states: “OK”(the data instance is running properly), “incommunicado” (the datainstance is in a suspect state of failure), or “dead” (the data instanceis unreachable and does not respond to requests for status).

In most cases, the host manager will return a response indicating thatthe host manger, associated instance, etc., is running as expected, andthe event processor can update information in the monitoring data store220. An event processor can consider a data instance to be in an “OK” orsimilar state in one embodiment when the host manager returns anappropriate response, such as an HTTP response code “200” (a standardresponse code for successful HTTP requests). If a response is notreceived from a host manager, or if the response is a timed-out response(such as HTTP code “500”, or any other “5xx” error response codes), theevent processor can resend the getStatus request, and can place thedatabase instance in an “incommunicado” or similar state. If the hosthas been in the “incommunicado” state for more than a predeterminednumber of status pings, or other such requests, then the data instancecan be declared to be in a “dead” or similar state. If the host comesback online with a “200” response (or similar) code within thepredetermined number of status pings, the host or instance can be movedto an “OK” state. The predetermined number of checks before moving ahost state from “incommunicado” to “dead” or “OK” used, at least inpart, is to avoid false positives due to intermittent network errors,temporarily overloaded event processors, temporarily overloaded hostmanagers, or other such temporary errors that do not actually result ina data instance being unavailable other otherwise requiring recovery. Inone embodiment, a state of “incommunicado” is not persisted, as thestate can easily be determined by another event processor.

If a reply is not received after the predetermined number of statusrequests, or the state is otherwise moved to a “dead” or similar state,as discussed elsewhere herein, the event processor enters informationregarding the problem state into the Admin data store 222 (or other suchjob queue as discussed above) indicating that there is a suspect statewith respect to the unresponsive host manager. As discussed above, asweeper 214 component of the control plane can periodically check theAdmin data store for information, and when the sweeper detects theinformation for the suspect or problem state, an appropriate recoveryworkflow can be started. For example, the sweeper can pass informationto the workflow component 216 that causes an appropriate workflow to begenerated, such as a workflow to handle a data instance beingunavailable, a workflow to handle errors reported by a host manager, orany of a number of other such situations. The workflow manager cangenerate the appropriate workflow, pass state information, and handlevarious other aspects as discussed elsewhere herein.

One advantage to storing recovery information in the Admin data store isthat such an approach allows for recovery even in the event of a failureof the monitoring system. It can be desirable to enable recovery actionsindependent of the availability of the monitoring data store. It can beacceptable to use the Admin data store, as in this embodiment any typeof recovery, including generating a workflow, etc., requires the Admindata store (or other such job queue) to be active and available. It canthus be desirable to avoid placing another dependency on the recovery,and instead having a single place of availability.

Systems and methods in accordance with various embodiments enablecustomers to utilize Web services, or a similar such approach, to createone or more replicated database instances in a cloud computing orsimilar environment, providing a highly durable and highly availabledata solution. When a customer creates a replicated database instance invarious embodiments, the customer data is synchronously replicated usinga primary-secondary replication model. In some embodiments, the replicascan be located in different physical locations, such as in differentdata zones. Each data “zone” can refer to one or more data centers, orgroups of data servers, for example, located within a specificgeographical area, with different zones being located at or arounddifferent geographic locations. An RDS instance then can tolerate thefailure of one of the data zones, as another data zone at a differentgeographic location can likely avoid the failure, except in the case ofa large catastrophic event. In some cases a data center can spanmultiple data zones, but data replicas within a given data center can beinstantiated in different zones. Many other variations are possible,such as overlapping zones, zones at multiple geographic locations, etc.If a primary replica fails or otherwise becomes unavailable, the RDSsystem can quickly and automatically failover to the secondary replica,resulting in very little downtime or data unavailability.

In one embodiment, a customer is able to create a replicated databaseinstance by calling a specified interface of the Web services layer ofthe control plane, such as is discussed with respect to FIG. 2. Forexample, a customer can call a “CreateDBInstance” API specifying aspectssuch as the instance class, allocated storage, database engine, etc., asthe customer would to create a non-replicated data instance. Whencreating a replicated instance, the customer can include at least oneadditional parameter, such as a “Replicated” or similar parameter, witha value set to “true” or any other appropriate value indicating that thecreated instance should be replicated. In some embodiments, the value isset to “false” by default such that non-replicated instances are createdunless otherwise specified by the customer. In some embodiments, onlycertain customers have the ability to create replicated instances, suchas a customer who pays for a certain level of service, etc.

In some embodiments, a customer also can select whether the secondaryreplica is created in a different data zone than the primary replica.The customer in some embodiments also can be allowed to select one ormore specific data zones for the instances, or an ordered list, forexample, while in other embodiments customers are not able to select thedata zone for at least the primary replica. If a customer specifies twodata zones and one of the data zones becomes unavailable for an extendedperiod of time, for example, the durability requirements in someembodiments would cause another replica to be generated in a third datazone, and so on. This could require management and updating of ordersdata zone lists for multiple customers, which can complicate the userexperience without providing any significant benefit. Further, it can beeasier for applications to spread the associated application fleetacross data zones, such that there can be some application fleetslocated in the same data zone as the secondary replica.

In some embodiments, a customer can call a “DescribeDBInstance” orsimilar API for the replicated data instance, whereby RDS can listinformation such as the endpoint DNS name of the primary replica and thedata zone in which the primary replica is currently located. Customerscan still communicate with the RDS instance using conventionalapproaches that would be used for a single data zone, as customers canreceive the endpoint DNS name of a data store as soon as the status ofthe RDS instance is “Available,” for example, and connect to theinstance using the endpoint DNS name. In the event of a replica failure,RDS can failover the database to the corresponding secondary replica,and the endpoint DNS name can will be aliased to the new primaryreplica. The database endpoint DNS name remains a constant in manyembodiments, not changing during the lifetime of the replicatedinstance.

In some embodiments customers can be provided with the ability toconvert a non-replicated instance to a replicated instance, such as bycalling a “ModifyDBInstance” or similar API with the Replicatedparameter set to “true.” This can cause the database to be converted toa replicated instance at an appropriate time, such as during the nextmaintenance window or immediately after the request, as may depend onthe API call parameters, etc.

Various embodiments take advantage of a block-level replicationmechanism, such as a kernel module that implements a share-nothing,replicated storage solution mirroring the content of block devicesbetween servers. BLRM works on top of block devices (i.e., hard disks orlogical volumes). It uses a primary-slave replication architecturewherein the primary replica directs all the updates to the underlyingblock device. All input and output (I/O) requests to the block deviceare intercepted by the BLRM kernel module, with all write operationsbeing automatically and synchronously replicated. BLRM provides inherentfailure detection of peer devices, and invokes appropriate recoveryhandlers when a peer node is unreachable. BLRM also can automaticallyresynchronize a temporarily unavailable node to the latest version ofthe data, in the background, without interfering with data access at theprimary replica. BLRM uses generation identifiers (“GIs”) to identifygenerations of replicated data, whereby BLRM can determine aspects suchas whether the two nodes are members of the same replica pair, thedirection of background re-synchronization (if necessary), and whetherpartial or full re-synchronization is needed. A BLRM driver can start anew generation at any appropriate time, such as during theinitialization of a replica pair, when a disconnected standby replica isswitching to the primary replica, or when a resource in the primary roleis disconnecting from the secondary replica. While a block-levelreplication mechanism is used herein as an example for purposes ofexplanation, it should be understood that any other appropriateblock-level technology or mechanism can be used within the scope ofvarious embodiments.

As discussed, RDS data instances in various embodiments can be builtupon one or more systems or platforms. For example, the instances can bebuilt upon a virtual computing environment that enables a customer toutilize Web services or another appropriate approach to launch instanceswith a variety of operating systems and manager those instances. Anexample of a Web service providing such a virtual computing environmentis the Elastic Compute Cloud (EC2) service offered by Amazon.com, Inc.The data instances also can be built upon a block-level storagemechanism that can provide off-instance storage that persistsindependently of the life of an instance. A block store mechanism canprovide storage volumes that can be attached to an instance and exposedas a device within the instance. An example of a block store platform isprovided in co-pending U.S. patent application Ser. No. 12/188,949,filed Aug. 8, 2008, entitled Managing Access of Multiple ExecutingPrograms to a Non-Local Block Data Storage,” which is herebyincorporated herein by reference. A logical volume (e.g., LVM layer) canbe built on top of the block storage volumes and an appropriate filesystem, such that the customer database can run on top of the LVM/filesystem layer. For a replicated database in one embodiment, BLRM can runon top of the LVM layer. BLRM in such an embodiment will intercept allI/O requests and send those requests to the logical volume, which inturn can split the requests across multiple block storage volumes. Theuse of a logical volume can provide the ability to handle multiple blockstorage E volumes, as well as the ability to easily expand storage, etc.Layering BLRM on top of LVM also can allow write operations to bereplicated across the replicas.

FIG. 4 illustrates an example of a mechanism 400 for implementing aprimary-secondary replication model to provide a replicated RDSinstance. In this example, the primary replica 410 and the secondaryreplica 412 are located in different data zones (1 and 2) of the dataplane 408, or database environment. Each replica is built on top of theblock storage mechanism, here illustrated as a BLRM layer 418, 422 formanaging I/O to a block store 420, 422 for each replica. The componentsof the control plane 406, such as may be similar to those discussed withrespect to FIG. 2, are able to create the replicated RDS instance byissuing configuration commands to the local host manager 414, 416, forexample, which can perform the necessary setup operations. As seen inthe figure, a block-level mechanism such as BLRM 418, 422 is positionedto intercept all I/O requests at the block device level, and writeinformation for the requests to the local disks and the remote disks420, 424. In this example, the database 426 (e.g., SQL) is run only inthe primary replica 410, and all clients 402 run their databasetransactions on the primary replica 410 (via an appropriate network404). The database 426 is not run on the secondary replica 412, and afile system also might not be mounted on the secondary replica, as thedatabase will generally not be aware of the updates in the underlyingdevice.

Each database client 402 can automatically discover the current primaryreplica using an RDS database DNS endpoint name, which can alias to thehost name of the primary replica 410. By using DNS to discover thecurrent primary replica, compatibility can be maintained with existingdatabase clients, such as native MySQL clients, JDBC, PHP, C #, andHaskell, for example. While DNS caching can potentially cause clients toattempt to connect to an old primary replica, a client will not be ableto talk to the database by connecting to a secondary replica, as nodatabase is run in the secondary replica. The customer can then know toobtain the proper DNS information.

As discussed, database replication can be supported across multipleunderlying data instances running in the same or different data zones.Once a write operation is committed using a synchronous approach, thedata will not be lost except in the extremely rare case where allreplicas are unavailable due to the failure of multiple data zones, etc.Such an approach can provide higher availability than a single databaseinstance, as a single replica failure does not cause an outage to thedatabase for an extended period of time. For instance, if the primaryreplica of a database is down, the system can perform a failoveroperation to a secondary replica in many cases. Further, such anapproach can provide higher durability than a non-replicated database,and can protect from failures such as a failure of an data zone orsingle block storage volume failure, etc.

As previously mentioned, RDS can take advantage of a block-levelmechanism such as BLRM to mirror the content of block devices betweenservers. A primary-slave replication architecture enables the primary toaccept and write all the updates to the block device. All I/O requeststo the block device are intercepted by the BLRM kernel module, such thatthe writes can be synchronously replicated. BLRM utilizes generationidentifiers (“GIs”) to identify generations of replicated data. BLRMuses this mechanism to determine whether two nodes are in fact membersof the same replica pair, as opposed to two nodes that were connectedaccidentally. GIs also can be used to determine the direction ofbackground re-synchronization, if necessary, and determine whetherpartial or full re-synchronization is needed. In at least oneembodiment, the GIs are universally unique identifiers (UUIDs) and arenot monotonically increasing sequence numbers. A BLRM driver can start anew generation during the initialization of replica pair, when adisconnected secondary replica is switched to the new primary replica,or when a resource in the primary role is disconnecting from thesecondary replica, etc.

In an example where a replica pair (e.g., primary replica P andsecondary replica S) is initialized and connected for the first time,the primary replica P can generate a new GI, such as GI₁. If the primaryreplica P gets disconnected from S and moves into a degraded mode, whereP performs all the I/O without synchronous replication, P can generate anew GI, such as GI₂. Even in the case where P and S are disconnected dueto a network partition, however, S will not generate a new GI. In thisexample, the primary replica P keeps in its metadata the new and theprevious GIs (GI₂ and GI₁, respectively). One reason for storing theprevious GI is to optimize on secondary replica recovery. For instance,there can be a temporary network partition that causes S to bedisconnected momentarily. Subsequently, when the partition heals andwhen S is reattached to P, P can see that the current GI of S is theprevious GI for P, such that P can ship only those blocks that werechanged between the two data generations.

In an example where there is a failure of the primary replica, S can bepromoted to the new primary replica when P is detected to beunavailable. When the command is issued to promote the secondary replicato the new primary replica, the BLRM can generate a new GI at the newprimary replica (formerly S). Thus, when P (the original primaryreplica) rejoins the cluster and communicates with S, P can determinethat the data generation has changed and P has to synchronize data fromS.

As discussed, the primary replica P can accept all writes and reads, andthe DNS_primary can alias or cname to the DNS name of the primaryinstance. The secondary instance S can receive all updates through DRDBreplication (or a similar block level replication) protocol from theprimary replica. No devices are mounted or databases started in thesecondary replica. When enabling failover, another component that can beutilized is a monitoring component M. A monitoring component can monitorthe health of the primary and/or secondary replicas and initiateappropriate failover actions when a failure occurs. The monitoringcomponent in one embodiment periodically pings, or otherwisecommunicates with, the primary and secondary replicas. Thiscommunication can include a heartbeat communication, for example, thathappens at regular intervals such as a number of seconds specified by aT_heartbeat or similar parameter. Whenever a monitoring component pingsP and S, the monitoring component in one embodiment issues a HTTPgetStatus( ) command to the host manager running in each replica. When Pand S each receive the call, the replicas can execute a BLRM or similarstatus call to determine the current state of each replica. For example,primary replica P can run a BLRM tool command to determine the status,such as IN_SYNC, STALLED, DEGRADED, DEAD, etc.

In addition to reporting the status, the each of the replicas can alsoreport their respective GI to the monitoring component, which can storethe generation numbers in memory. Whenever a new monitoring componentbootstraps, the new component can read the list of replica pairs, aswell as the endpoints, from a strongly consistent data store (i.e., themonitoring database), and store the information in memory. During eachstatus ping, the monitoring component can determine whether the numberis same. If for some reason the number is different, the GI value can beupdated in memory.

A primary or secondary replica can be in one of at least two monitoredstates. FIG. 5 illustrates an example of a state transition diagram 500for a primary replica in accordance with one embodiment. A replica canhave a MONITORED state when the replica is connected to the monitoringcomponent. A replica can be in a NOT_MONITORED or similar state when thereplica is not connected to the monitoring component. A primary instancecan also be in one of a plurality of data synchronization states. Forexample, P can be in an IN_SYNC state when both P and S are up and cancommunicate with each other, where all writes are synchronously writtenbetween P and S. Viewing the state diagram, at 504 where the primaryreplica is in an IN_SYNC/Monitored state, the primary replica cancommunicate with the secondary replica, all writes are succeeding, theBLRM is heartbeating, and the primary is being monitored. If the primaryis disconnected from the monitoring component but still in sync with thesecondary replica, the state can transition to state 502. At state 502,the primary can communicate with the secondary replica and both replicasare connected and up-to-date, but the primary is disconnected from themonitoring component and thus is not being monitored. The secondaryreplica can also be in a CONNECTED state, where the secondary replica ishealthy and in contact with the primary replica, and can be in aDISCONNECTED state when the secondary replica is healthy but out ofcontact with the primary replica. Thus at states 502 and 504 thesecondary replica would be CONNECTED, but at the other states would beDISCONNECTED.

The primary replica can have a STALLED or similar state 508 when P ismonitored but is disconnected from, or otherwise out of contact with S,and cannot proceed with any I/O operations, as all writes are frozen.The primary replica can have a DEGRADED or similar state 406 when P isdisconnected from S and has switched to non-replicated mode. This allowsP to continue serving reads and writes when S is down or otherwiseunreachable. P can reach the DEGRADED mode from either of states 502 or508. P may not remain in DEGRADED mode for long in many embodiments, asRDS will typically create a new standby replica. Once a new secondaryhas been instantiated, is fully synchronized with the primary replica,and is being monitored by the monitoring component, the state cantransition back to state 504, where the replicas are IN_SYNC andMonitored.

The primary replica can be in a SUICIDAL or similar state 510 when P isdisconnected from S and also is in, or otherwise enters, a NOT_OBSERVEDstate. In this case, the state of P can be changed to SUICIDAL after aperiod such as T_failover seconds. This state 510 can only be reachedfrom a STALLED state 508 in some embodiments, and occurs when P is outof contact with the monitoring component. In this state, the primaryreplica “kills” itself by shutting itself down, or rebooting its datainstance.

As part of a monitoring and failover architecture for implementing suchprocesses, each replicated database (i.e., the replica pair) ismonitored by a monitoring component. In RDS, a single monitoringcomponent can monitor multiple replica pairs. Further, the system canutilize a plurality or “fleet” of monitor nodes. As discussed, amonitoring component can determine the state of a monitored database bycontinually pinging the replica pair at appropriate intervals, such asevery T_heartbeat seconds. FIG. 6 illustrates an example of a statetransition diagram 600 for a replicated database from the point of viewof a respective monitoring component M. When the primary replica is inan IN_SYNC state and the secondary is connected, M can view the databaseas being in an IN_SYNC or similar state 604. M can also view thedatabase as being in state 604 when the monitoring component cannotcommunicate with one of the replicas due to a network partition, forexample, but the other replica indicates to the monitoring componentthat the replicas are connected and in sync, such that there is no needto perform a failover event.

If for some reason M can no longer communicate with both the primary andsecondary replicas, either the monitoring component is partitioned awayor both replicas are unavailable at the same time. In either case, M canview the state of the database as moving into a Partitioned or similarstate 602. This can put both the primary and secondary replica in aNOT_Monitored state. When the monitor partition heals or when a newmonitoring component is assigned to the database, the state can returnto an IN_SYNC state 604.

If M can no longer communicate with the primary replica, and thesecondary replica cannot communicate with the primary replica such thatit is in a Disconnected state, the monitoring component can view thedatabase to be in an S_ONLY state 606. If, within a period of time suchas T_failover seconds, the monitoring component is able to re-establishcommunications with the primary replica, the state can return to IN_SYNC604. If the monitor is not able to communicate with the primary replicafor at least T_failover seconds, the monitoring component can decide topromote the secondary replica to the new primary. If the secondaryreplica confirms that the current GI is the same as the last known GI ofthe primary replica, and the secondary replica confirms the promotionrequest, the state can transition to a P_ONLY state 608, until a newsecondary is instantiated and fully synchronized with the new primary,at which time the state can transition back to IN_SYNC 604.

If, however, the monitoring component decides to promote the secondaryreplica to the new primary replica, but the secondary request rejectsthe promotion request, the state can transition to a Disaster or similarstate 610. The secondary might reject the request because the current GIfor the secondary replica is different from the last know GI of theprimary replica. In other cases, a response might not otherwise bereceived from the secondary replica. This could happen when there is amassive unavailability, or in the highly unlikely event that the GI ormembership information has been corrupted, etc.

In another case where the state is IN_SYNC 604, the monitoring componentmight lose the ability to communicate with the secondary replica, andthe primary replica might also lose the ability to communicate with thesecondary replica such that the primary replica is in a STALLED state.In this case, the state monitoring component can request that theprimary replica move to a DEGRADED state, and the state as viewed by themonitoring component can transition to a P_ONLY or similar state 608.With the monitoring component and primary replica not able tocommunicate with the secondary replica, and the primary replica being ina DEGRADED mode, a new secondary replica can be instantiated and fullysynchronized with the primary replica, whereby the state as viewed by Mcan transition back to IN_SYNC 604.

As can be seen by the state transition diagrams, a failover algorithmimplemented by the monitoring components in at least one embodiment cancause a monitoring component to promote a secondary replica to be thenew primary replica for an instance under certain circumstances. Asshould be understood, this example merely represents one path throughthe state diagram of FIG. 6. FIG. 7 illustrates an example process 700for failing over to a secondary replica that can be used in accordancewith one embodiment. In this example, the primary and secondary replicasare provisioned, connected, and synchronized 702. A generationidentifier (GI) is generated for each replica to identify the currentgeneration of replicated data 704. A monitoring component is assigned tothe replicas and periodically pings the replicas 706. A monitoringcomponent being assigned to a replica pair can obtain, or be providedwith, a “lease” for that pair, which can expire after a period of time.The lease typically will be received from a host manager for the primaryreplica, and an event processor identifier and lease time can be storedin both replicas such that the event processor leasing scheme is able tosurvive the crash of a primary replica. In this way, monitoringcomponents can periodically be released from replicas, and thus can bemoved to other pairs for purposes of load distribution or partitioning,or otherwise manipulated for any of a number of other such reasons. Ator near the end of a lease period, a monitoring component can attempt torenew the lease, a decision can be made not to renew a lease, etc., asdiscussed elsewhere herein. If the monitoring component loses contactwith the primary replica 708, the monitoring component can attempt toretry for a period of time 710. If the monitoring component regainscontact with the primary at any time, the monitoring process cancontinue. If the monitoring component is out of contact with the primaryreplica for a period of time such as T_failover seconds, a determinationis made as to whether the secondary replica is able to communicate withthe primary replica 712, or whether the secondary replica is in aDISCONNECTED state. A determination also can be made as to whether thestate of the primary replica at the time contact was lost was known tobe IN_SYNC with the secondary replica 714. The determinations can bemade separately or at substantially the same time in variousembodiments. If the secondary replica cannot communicate with theprimary replica, and the replicas were synchronized (e.g., had the sameGI value), the monitoring component can issue a command to promote thesecondary replica to the new primary replica 716. If the last state of Pcannot be determined, no failover occurs. A monitoring component may notknow the state of P if the process or machine rebooted, or if a newmonitoring component took over. In that case, the state can be treatedas DEGRADED.

When promoting a secondary replica to be the new primary replica, amonitoring component can issue a command such as promoteToPrimary(oldGI) to the host manager for the secondary replica. In this example,“oldGI” is the last known GI of the host manager for the primaryreplica. Upon receipt of this request, the secondary replica can try onelast time to communicate with the primary replica. If the replicas stillcannot communicate, the secondary replica verifies that its current GIis same as oldGI (of the primary replica) 718. The secondary replicaalso can verify the leasing information, whereby the monitoringcomponent issuing the request or sending the status request is a validmonitoring component for that replica, or the current “lease holder” forthe replica. If so, the secondary replica confirms that it can promoteitself, and becomes the new primary by issuing the appropriate BLRMcommand 720. The secondary replica returns the new GI to the monitoringcomponent as a response to the promoteToPrimary( ) request.Subsequently, the host manager for the new (promoted) primary replicamounts the file system and starts the database (e.g., MySQL) 722. Whenthe monitoring component has successfully promoted the secondaryreplica, the DNS_primary cname can be pointed to the new primary replica724, as may be performed by the monitoring component or other componentof the control plane. Subsequently, the instance state can be marked tobe in need for secondary recovery 726.

If, however, the current GI for the secondary replica is not the same asoldGI, it might not be safe to promote the secondary replica to be thenew primary replica. In this case, the promotion process can be abortedand an alarm generated for operator intervention (or another appropriateremedial action). If the operator cannot resolve this issue, apoint-in-time recovery can be performed by restoring the database to thelast well known point.

Viewing the diagrams, a number of different failure cases can bedetermined. For example, in a first failure case the primary andsecondary replicas are running, and are communicating with an operatingmonitoring component. From the point of view of the monitoringcomponent, as long as the component is able to communicate with eachinstance periodically, such as within at the most T_monitoring componentseconds, everything is running as expected. The primary's state in thiscase would be “IN_SYNC/OBSERVED.”

In the failure case where the network link between the monitoringcomponent and the secondary replica is partitioned away, however, theprimary would be able to communicate with the secondary and themonitoring component, but the monitoring component would not be able tocommunicate with the secondary replica. From the primary's point ofview, all writes are still successful such that the primary is still inan IN_SYNC/OBSERVED state such that no secondary recovery is initiated.From the point of view if the monitoring component, the componentdetects a secondary failure, but the primary is still synchronized withthe secondary so the monitoring component does not have to perform andoperation and can simply continue attempting to communicate with thereplicas.

If, instead, the monitoring component is not able to communicate withthe primary component, such as in response to a network partition, thesecondary replica will be able to communicate with the primary replicaand the monitoring component but the primary replica will be unreachablefrom the monitoring component. From the point of view of the primary,after n*T_heartbeat seconds, the primary will move to a NOT_OBSERVEDstate, as the primary replica not been in contact with the monitoringcomponent. In some embodiments, the value of n can be set to n≥2. Thestate of the primary thus can be IN_SYNC/NOT_OBSERVED. From the point ofview of the monitoring component, only the secondary replica isreachable but the secondary replica is still in contact with the primaryreplica, such that the monitoring component does not initiate anyfailover.

In one example failure case, the secondary replica might be down due tofactors such as a node failure or network partitioning. FIG. 8illustrates an example of a process 800 for performing secondaryrecovery that can be used in accordance with at least one embodiment.This example assumes that the replicas are already provisioned,communicating, and synchronized, and the replicas are being monitored bya monitoring component 802. If the monitoring component loses contactwith the secondary replica 804, the monitoring component can attempt toretry for a period of time 806. If the monitoring component regainscontact with the secondary replica at any time, the process cancontinue. If the monitoring component is out of contact with thesecondary replica for a period of time, a determination is made as towhether the primary replica is able to communicate with the secondaryreplica 808. If the primary replica is unable to communicate with thesecondary replica, the primary can go into a STALLED state after T_syncseconds 810. After entering the STALLED state, the primary replica canwait for n*T_heartbeat seconds to hear from the monitoring component. Ifthe primary replica hears from the monitoring component within this timeunit (i.e., the primary is in a MONITORED state), the primary goes to aDEGRADED state and informs the monitoring component in the nexthandshake 812. From the point of view of the monitoring component, thestate goes to P_ONLY, where the monitoring component finds that thesecondary replica is unreachable. Upon determining this, the monitoringcomponent marks the state of the database instance as a state such asNEED_SECONDARY_RECOVERY, and initiates a secondary replica recoveryworkflow 814, such as is discussed elsewhere herein.

In another failure case, all the hosts can be up and running, but theprimary replica can be partitioned away from the monitoring componentand the secondary replica, such as may be due to an data zone partitionor a bad rack uplink. Thus, the monitoring component is able tocommunicate with the secondary replica, but neither the monitoringcomponent nor the secondary replica is able to reach the primaryreplica. From the point of view of the primary replica, after T_synctime units, the primary replica goes into a STALLED state. Afterentering the STALLED state, the primary replica waits for n*T_heartbeatseconds to hear from the monitoring component. In this case, the primaryreplica does not hear from the monitoring component and is disconnectedfrom the secondary replica, such that it moves into a SUICIDAL state and“kills” itself by rebooting its instance when it comes back as asecondary replica. From the point of view of the monitoring component,the monitoring component reaches the state of S_ONLY, where it findsthat the primary replica is unreachable. The monitoring component checkswith the secondary replica in the next handshake to determine whetherthe secondary replica can communicate with the primary replica. In thiscase, the secondary replica will claim that it is in a DISCONNECTEDstate. The monitoring component waits for T_failover seconds and thenconfirms that the primary replica is still unavailable. If so, themonitoring component causes the secondary replica to be promoted to bethe new primary replica, if the previous state of the database was inIN_SYNC and if the current GI of the secondary replica is same as lastknown GI of the primary replica. The time value of T_failover can be setto n*T_heartbeat+T_buffer, where n is the same parameter as previouslydescribed before in earlier cases, set to n≥2. T_buffer is the worstcase time expected for the primary replica to “kill” itself.

In a similar case where the primary is down and there are no otherissues, there also can be a failover. In this case, however, the primarydoes not have any transition states as the primary replica has gone downand will not go into a SUICIDAL or other such state.

In another failure case, the primary and secondary replicas can befunctioning and communicating as expected, with no network issues, butthe monitoring component can go down or otherwise become unavailable.From the point of view of the primary, everything is still in an IN_SYNCdata synchronization state, but the primary replica notes that it is ina NOT_OBSERVED state.

As discussed, the control plane includes a distributed set of eventprocessors, or event processing fleets, configured to monitor the RDSinstances and issue appropriate recovery actions when necessary. Eachevent processor can be assigned a portion of the monitoring workload fora portion of the RDS instances, such as by employing a simple hash-basedpartitioning algorithm where the hashing is done based on anInstanceIdentifier or similar identifying value. For monitoring areplicated instance, an event processor can function as the monitoringcomponent. An event processor can determine the health of an RDSinstance by pinging, or otherwise communicating with, all the replicasassociated with that instance. If an instance is not replicated, thenthe event processor only needs to communicate with the single hostmanager for the instance.

There can be special considerations to partitioning the instancemonitoring workload among the event processing fleets when there arereplicated instances. In some embodiments, the monitoring system shouldscale substantially linearly as the number of instances increases. Thisscaling can be accomplished in various instances by adding additionalevent processors (e.g., hosts). There also can be constraints on theplacement of the of the event processor, as it can be desirable for theevent processor to be located in a different data zone from eachreplicas of the database being monitored by that event processor. Byplacing the event processor in a different data zone, the failure of adatacenter does not result in two simultaneous failures (e.g., failureof the monitoring component and at least one of the replicas) happeningat the same time, causing the database to potentially reach anirrecoverable state. It also can be desirable to ensure that eachdatabase instance, including all replicas, are continually monitored.This can be accomplished in various embodiments by partitioning thedatabase instances and assigning the monitoring ownership of eachpartition to one of the event processors. If an event processor failsfor any reason, the partitions owned and monitored by the failed eventprocessor should be redistributed evenly to other available eventprocessors.

To ensure linear scalability of the monitoring system and still meet theconstraints on the placement of the event processors, the eventprocessing fleets in at least one embodiment are segmented intodifferent groups based on the data zone in which each fleet resides.Each group can be configured such that the event processors within agroup are associated with RDS instances whose replicas are not in thesame data zone as the respective event processor.

As an example, there can be four event processor groups (G1, G2, G3, andG4) covering instances in four respective data zones (DZ1, DZ2, DZ3, andDZ4). For each replica pair, the monitoring workload can be apportionedbetween the groups that are not in the same data zones as the replicapair. In this example, the monitoring workload of RDS instances whosereplica pairs are in DZ2 and DZ3 can be split across the eventprocessors in G1 and G4. For replica pairs in DZ3 and DZ4, the workloadcan be is split between groups G1 and G2.

For all the replicated databases located in a given data zone, eachevent processor can compute the list of event processors that cover andata zone pair independently. Subsequently, for a given data zone pair,the event processor identifiers covering that data zone pair can besorted lexographically. The database identifiers also can be sorted, andsplit across the zone pairs uniformly. For example, there can databaseswith replicas in zones DZ2 and DZ3. These databases can be monitored byevent processors in groups G1 and G4 together. For sake of simplicity,the database identifiers of the database in this data zone pair can beset as (DB1, . . . , DB1000), and there are two event processors ingroup G1 (EP1 and EP2) and two event processors in group G4 (EP3 andEP4), respectively. In this example, when EP1 bootstraps, EP1 candetermine that there are 1000 databases to be monitored in the data zonepair (DZ2, DZ3) and four event processors that cover them. By sortingthe event processor identifiers lexographically, EP1 can determines itcan take DB1 to DB250, EP2 can take DB251 to DB500, EP3 can take DB501to DB750, and EP4 can take DB751 to DB1000. EP1 can repeat the samesteps to determine the databases that EP1 is in charge of monitoring forevery replica pair it is eligible to monitor.

To detect the failure of an event processor, each event processor can beconfigured to send a HEARTBEAT message (e.g., over HTTP) to every otherevent processor periodically, such as every ten seconds. The eventprocessors also can maintain a list of event processors and their status(e.g., AVAILABLE or DEAD) along with the last check-in time of eachevent processor. When a first event processor has not heard from anotherevent processor for a time period greater than heartbeat_failure_time,which is typically some multiple of the heartbeat interval such as sixtimes the heartbeat interval, the first event processor can declare theunresponsive event processor to be DEAD, or in a similar state, and canadjust its monitoring workload. When the unresponsive event processorhost starts or recovers, the event processor can start itself in aBOOTSTRAP or similar mode for a time period, similar to theheartbeat_failure_time, to receive heartbeats from its peer eventprocessor, and can start its heartbeating agent. After this time, theevent processor can move itself to an OPERATIONAL mode where itdetermines its current slice of monitoring workload based on the stateof the event processors assigned to its partition. One reason forleaving the event processors in BOOTSTRAP mode for a period of time isto ensure that the new event processor that joins the event processorcollective and the remaining event processor have sufficient time toconverge on the current state of active event processors.

In the event of a failure of an data zone, it is desirable to ensurethat the instances being monitored by event processors in the faileddata zone are taken over by the remaining groups. In one example, fourevent processor groups (G1, G2, G3, and G4) cover event processors infour data zones (DZ1, DZ2, DZ3, and DZ4) respectively. If DZ1 dies, theinstance monitoring by the event processors in DZ1 can automatically betaken over by the event processors in the other data zones.

It is possible, however, that there might only be three data zones in aregion, with three event processor groups (G1, G2, and G3) monitoringdata zone pairs (DZ2, DZ3), (DZ3, DZ1), and (DZ1, DZ2). In the eventthat DZ1 goes down, G2 and G3 need to be redeployed in such a way thateach group monitors instances whose secondary replica is in the samedata zone as itself, in order to tolerate the failure of the data zonecontaining the primary replica. In various embodiments, a flag such as a“secondary-dz-colocation-override” flag can be turned on only when andata zone is out in a three-DZ region. If this flag is turned off, thegroups partition the monitoring workload with the constraint that anevent processor cannot reside in the same data zone as the replicapairs. If the flag is on, the group can override the constraint andre-align itself to select RDS instances whose secondary replica is inthe same data zone as itself. This flag can be persisted in a monitoringdatabase or similar data store in the control plane.

It also can be desirable to ensure that there is only one eventprocessor monitoring a particular RDS instance. In certain embodiments,the failover algorithm requires that a single monitoring component(i.e., event processor) monitors a replica pair at any give time. Thisconstraint can be utilized because it can be undesirable to have twoevent processors on either side of a network partition, with one eventprocessor one trying to failover an RDS instance and another assumingthat the primary is still alive, leading to a “split brain” scenario.

To ensure that only a single event processor is monitoring an RDSinstance, an event processor can be required in some embodiments toexplicitly acquire a lease from the primary replica of an RDS instance.In other embodiments, the monitoring component can acquire a lease fromanother component of the control environment, which manages the leasesand interacts with the various components in the data environment. Onlyupon acquiring a lease from the primary replica of an RDS instance is anevent processor eligible to initiate the failover for a given RDSinstance, and only for the lease period such as T_lease. An eventprocessor can acquire a lease from an RDS instance primary replica inone embodiment by pinging a database replica (e.g., by issuing a HTTPstatus ping( )), whereby the host manager of the database replica canhand out a lease, in addition to its usual response. In some embodimentsthe lease is handed out only if the replica is the BLRM primary, theprimary and secondary replicas are in sync, and if there is still avalid lease given to another event processor. When the primary replicahands out the lease to an event processor, the primary replica can writethe lease time and the event processor identifier to its BLRM drive. Bywriting to the BLRM disk when it is in-sync, the primary replicainherently notifies the secondary replica of the lease. Thus, only afterthe lease time and event processor identifier are successfully written(i.e., replicated in both replicas) will the primary replica hand out anew lease to the event processor. Further, by writing the eventprocessor identifier and lease time in both replicas, the eventprocessor leasing scheme is able to survive the crash of a primaryreplica. The secondary replica of an RDS instance never hands out anylease at any time in at least some embodiments. The secondary replicacan accept a promoteToPrimary( ) or similar request only if the requestis from the event processor whose identifier is same as the one in itsBLRM drive.

When an event processor reboots or a new host takes over, the eventprocessor assumes the state of the RDS instance (it has not monitoredbefore) to be P_ONLY, a state where the primary replica is in DEGRADEDmode. The event processor pings the primary and secondary replicas todetermine the current state of the database and changes its stateaccordingly. As noted earlier, the event processor does not initiate anyfailover if a primary replica is assumed to be in DEGRADED state. Bytaking a “pessimistic” approach, there will be fewer mistakes when a newevent processor takes over. When an event processor reboots or a newevent processor takes over, the event processor pings both the replicasassociated with a given host to determine which replica is the currentBLRM primary. Once this information is collected, the event processorcan check with the appropriate pDNS API to ensure that the DNS_primaryCNAME points to the current primary replica. If not, the event processorcan failover right away. This scenario can happen if an event processorhas died in the middle of failover. Since it is possible that the DNSinformation can be incorrect due to DNS caching and other effects, thepDNS API can be queried without resolving the DNS name, as pDNS APIreads the authoritative database. However, in the unlikely event thatboth the primary and secondary replicas think they are the rightfulprimary replica, the operator or responsible technician can be paged,etc.

The monitoring database in the control plane can store the list ofcurrent active database instances to be monitored, the type of eachinstance (e.g., replicated), and any events that the event processorscollect for different customer-related events. As the number ofdatabases increase, it can be necessary in some embodiments to scalebeyond a single monitoring database. To this end, all the tables in themonitoring database can be partitioned. To enable monitoring DBpartitioning, a “db partition map” can be employed along with the eventprocessors. When an event processor has to persist an event related to adatabase instance, the event processor can consult the “db partitionmap” to determine the appropriate database to which to write informationfor the event.

FIG. 9 illustrates an example process 900 for monitoring the health ofevent processors in a bucket and handling the failure of one of theevent processors in accordance with one embodiment. In this example, atleast one workload partition is determined for the data plane 902.Depending at least in part upon the number of data stores, instances,host managers, and other such components to be monitored, the overallworkload may be partitioned into any of a number of separate partitions.A set of event processors can be assigned to each workload partition904, and each event processor in the set is allocated a respectiveportion of the work for the assigned partition 906. At the appropriateintervals, each event processor sends a “heartbeat” message (e.g., overHTTP) to the event processors in the same set or bucket covering thesame workload partition 908. The heartbeats can be sent at anyappropriate interval, such as every ten seconds. A “heartbeat” in oneembodiment refers to a simple multicast message that is sent to eachevent processor in a bucket to inform the other event processors of thestatus of the event processor sending the heartbeat. The eventprocessors can maintain a list of event processors and their status(e.g., “available” or “dead”) along with the last check-in time of eachevent processor. If it is determined that a heartbeat is received fromeach event processor in the bucket 910, the process can continue.

If, however, it is determined that an event processor in the same buckethas not responded with a heartbeat, then a determination is made as towhether the event processor has failed to send a heartbeat for a timeperiod equal to, or greater than, a specified heartbeat failure time(e.g., be six times the heartbeat interval) 912. If the specifiedheartbeat failure time has not been reached, the process can continue.If the heartbeat failure time has been at least reached without aheartbeat from an event processor, each active event processor in thebucket can declare the non-responsive event processor to be “dead”, orin a similar state, and can reallocate the responsibility ranges andtake over a portion of the monitoring workload 914. As every activeevent processor in the bucket will fail to receive a heartbeat messagefrom the failed event processor, the event processors can each expandthe allocated workload by an appropriate amount to pick up the work ofthe “missing” event processor.

If there are four event processors and 60,000 instances being monitored,as illustrated in the example 1000 of FIG. 10, then each event processorhandles 15,000 instances (which can be ordered in lexographical order oranother appropriate order by identifier, etc.). If one of the eventprocessors fails, the other three event processors can re-allocate theirrespective range of responsibility, such that each event processor nowhandles 20,000 of the instances (still being consecutively orderedaccording to the identifier, etc). Thus, since the instances are orderedusing an ordering scheme, the event processors can adjust the range ofthe ordering scheme to be monitored, and do not have to map or otherwisetrack which “new” instances to monitor. The ranges being monitored canbe stored in the monitoring data store, for example. Such an approach isalso beneficial in situations where instances are added or removed, asthe workload can be automatically distributed (substantially) evenlyacross the event processors. Heartbeating only within a particularbucket also can be more efficient and easy to maintain than a globalheartbeating mechanism.

FIG. 11 illustrates an example process 1100 for reallocating the workranges across a bucket when an event processor is added to the bucket,such as may be a result of adding additional processing capacity or aresult of a failed event processor recovering and again being able tohandle a portion of the workload. An event processor can become active1102, such as by an event processor host restarting or recovering, orthe host simply being activated or added to a bucket. The eventprocessor also can be added to the bucket 1104, although in cases ofrecovery the event processor might already be assigned to that bucket.Upon the active event processor being added to the bucket, the eventmanager can enter a mode such as a “bootstrap” mode for a time period(e.g., the heartbeat failure time) to receive heartbeats from the peerevent processors in the bucket 1106, to obtain information about theother event processors active in the bucket and determine a time forsending heartbeats, for example. The event processor can engage aheartbeating agent to also start sending heartbeats to the other eventprocessors in the bucket 1108. After this time, the host can move itselfto an “operational” mode, where each event processor can reallocate therange of work and determines its current slice of monitoring workloadbased on the state of the event processors assigned to its partition1110. One reason for leaving the event processors in “bootstrap” modefor a period of time is to ensure that the new event processor thatjoins (or rejoins) the event processor collective, and the remainingevent processors, have sufficient time to converge on the current stateof active event processors.

An approach in accordance with one embodiment also over-partitions theevent processors, such as by running each event processor at 50-60% ofcapacity. Such an approach enables at least one or two event processorsto fail in each bucket without having a significantly negative impact onperformance. A failed event processor will eventually become availableagain, such as where the respective host reboots. That event processorthen can start exchanging heartbeats again, whereby the other eventprocessors in the bucket can automatically detect the presence of theevent processor. The allocated work can be automatically redistributedas discussed above, so that the work is relatively evenly distributedacross the larger set of available event processors in the bucket.

In addition to the failure cases discussed above, there can be variousother failure modes that can be addressed in accordance with the variousembodiments. For example, a primary replica instance might reboot, suchthat when the host manager for the primary comes back online it firstwill find that the BLRM status has changed from “primary/secondary” to“secondary/secondary,” as the primary replica comes back online as asecondary replica if the monitoring component has not already failedover to the secondary replica. It then can be up to the event processor(e.g., the monitoring component) to determine who should be the primaryamong the two replicas and make the appropriate promoteToPrimary( )call. If a secondary replica instance reboots, the monitoring componentwill notice that secondary is out and can mark the instance forrecovery. However, in the meanwhile, if the secondary replica comes backonline (after reboot), the secondary recovery workflow can notice thisand request that the host manager for the secondary replica attempt toreconnect. This can avoid the expense of creating a fresh secondaryreplica for a simple instance reboot scenario. If a non-replicatedinstance reboots, the host manager can automatically convert its statusfrom a secondary to a primary replica without requiring the monitoringcomponent to promote the instance. This can reduce the recovery time forinstance reboot for a non-replicated instance.

When a primary replica fails and does not come back online, themonitoring component can detect the primary failure and promote thesecondary replica to be the new primary. Subsequently, the monitoringcomponent can mark the RDS instance state in the Admin data store to bein a state such as “PENDING/DEGRADED_NEED_SECONDARY_RECOVERY”. Thisstate can cause a recovery sweeper to kick start an appropriate recoveryworkflow. The recovery workflow can attempt to determine whether bothreplicas are alive. If the old primary replica has come back online as asecondary replica, such as where the reboot took a sufficient amount oftime such that the monitoring component marked the replica as dead, theworkflow can connect the old primary replica to the new primary and markthe recovery done, such as with a database state of OK, once thereplicas are fully synchronized. However, if the old primary has notcome back at all, the workflow can terminate the old instance and spinoff a secondary replica using the same steps described with respect tocreating a replicated instance. If the secondary replica fails, themonitoring component can detect the failure and mark the instance statein the Admin data store to be in a state where by recovery workflowkicks in, such as by using a “PENDING/DEGRADED_NEED_SECONDARY_RECOVERY”or similar state. When the database crashes for some reason, the hostmanager of the primary replica can act as the nanny process and restartthe database automatically.

As discussed, each partition of the monitoring workload can be coveredby a set of event processors. Covering a single partition of theworkload with a set of event processors enables the redistributing ofthe monitoring load across the remaining event processors in the eventthat one of the event processors fail or experiences any of a variety ofother such problems. In one embodiment, each group of event processorsis contained in a bucket or other such partition. Each event processorin a bucket is responsible for handling a range of instances in a singledata plane, or grouping of instances in that plane. A failure detectionprocess can be used to ensure that if a failure occurs, the other eventprocessors in that bucket take over responsibility for the instanceshandled by the failed event processor. The monitoring data store in atleast one embodiment holds the list of current active data instances tobe monitored by the set of event processors in a bucket, as well as theinformation that the event processors collect for variouscustomer-related events. As the number of monitored instances increases,it can be necessary to scale beyond a single monitoring data store.Thus, each table in the monitoring data store can be partitioned,including the db_poll_list.

In one embodiment, the event processors are deployed with a partitiontable of the following example format:

Partition Id Hash Range P0   0-10000 P1 10000-20000This partition configuration can be deployed as a configuration file tothe event processor hosts.

If a given workload partition generates a significant number of eventsthat leaves the responsible set of event processors in a constantcatch-up mode (i.e., not able to finish the assigned health checkswithin a certain time period), additional event processors can be addedto the set responsible for that workload partition without having torepartition the data store. Using such a technique, the performancescalability can be differentiated from the data scalability issues. Forexample, a single partition generating so many events that the eventprocessors cannot catch up can be distinguished from a situation wherethe single partition generate so many events that a single data storedoes not provide enough storage space.

The membership of the event processors and the partitions to which theevent processors are assigned can be stored in a location such as anevent processor membership configuration file. The membershipconfiguration information can be deployed to the event processors in agroup (such as in the same partition or bucket), and can have thefollowing example format:

<EP identifier><EP Host Name><endpoint_port><Partitition Id>

When a single partition is covered by multiple event processors, eachevent processor splits the bucket ranges by sorting the event processoridentifiers, such as by using a lexographic or hash-based sortingroutine, and dividing the bucket ranges uniformly. Each event processorcan independently determine the appropriate range to be monitored.

In such a system, it can also be important to ensure that the list orset of data stores and/or instances to be monitored are automaticallypopulated and updated over time. One approach would be to create adatabase list table, for example, which is a shapshot replica of theinstances which can be propagated as needed. Such an approach, however,can be difficult to maintain, as well as to ensure that each appropriatecomponent has the most recent copy. Another approach would be to havethe event processors query the data plane components, and then store theinformation locally in the control plane. Such an approach can create alot of messaging traffic, and can be difficult to maintain and update.An approach in accordance with one embodiment instead enables each eventprocessor to expose an interface such as a “setStatus” or similar API.As part of a “create” or “delete” workflow, for example, a task can beadded to the end of the workflow which instructs the appropriate hostmanager to call the event processor that is, or was, in charge ofmanaging the instance. The host manager can thus call the “setStatus”API of the event processor to set a status of the host, any time thereis a change in status as a result of a workflow (or other such action).Each time an event processor receives a call through the “setStatus”API, information can be placed in a local data store to add the new hostto its set of partitions, remove the host, etc. Information for the hostalso can be written to the monitoring data store or another appropriatepersistent location.

In one embodiment, an authoritative list of current active datainstances resides in the Admin data store. An active list of datainstances to be monitored resides in the monitoring data store in atable such as a “db_poll_list” table. To add, remove, or update thestatus of an instance in the monitoring data store, the event processorsexpose an “updateHost” API that accepts parameters such as a data storeidentifier, data instance related parameters (e.g., an instanceidentifier and a DNS address), and an instance status (e.g., “add”,“remove”, or “update”). When an event processor receives this call, theevent processor makes the appropriate changes (e.g., adding, removing,or updating an entry) to the db_poll_list table. For example, if acustomer submits a request to create a data store with a data store id“id1”, the workflow for creating the data store will, upon provisioningthe necessary resources and configuring the data store, mark the stateof id1 as “available” in the Admin data store. As a final step in thecreate database workflow task, the updateHost API can be invoked at oneof the event processors, such as by reaching through an internal virtualIP, to add the data store (and its instances) to the monitoringworkflow. By making the updating of monitoring status the final (or atleast near-final) step in the provisioning workflow, the availability ofthe creation, deletion, or modification of an RDS data store isdecoupled from the availability of the monitoring data store.

Once the host manager sets the status for an active instance to bemonitored, the responsible event processor can periodically ping thehost manger for the instance as discussed elsewhere herein. If aninstance is unavailable, such as may be due to a host machine crashingor rebooting, the event processor will not get a response for theinstance and will write information for the potential problem to theAdmin data store. A sweeper will detect the information, and will causean appropriate recovery workflow to be generated and executed. In oneembodiment, a recovery workflow first examines the history of metricsfor a data store or data instance, such as information detailing ahistory of I/O errors for an instance. The workflow then attempts toautomatically determine whether the instance is down, such as wherethere are connection errors, or whether the are no connection problemsbut an increased number of I/O errors, indicating a potential problemwith a particular volume supporting the instance. The tasks of theworkflow can attempt to automatically determine and/or isolate theproblem, where there are a number of different problems that can occurfor a number of different components. Such a determination, as well asthe recovery from such problems, is not a trivial matter.

There can be situations, however, where it might not be desirable toautomatically recover from a failure. For example, it is possible for anentire data center to fail, where thousands of data stores becomeunavailable. It can be undesirable to attempt to recover all these datastores at substantially the same time. In one embodiment, the sweeper(or another component of the control plane) can be configured with amaximum number of errors or concurrently executing workflows of aparticular type. If a number of workflows exceeds a specified number orthreshold, for example, a message or other such notification can be sentor otherwise generated for an operator or DBA, whereby an experienceduser can determine the best approach to solving the situation. In oneembodiment, the sweeper will run at most a specified number of workflowsof the same type at any given time, such as ten workflows of a giventype, but will not generate an alarm until a second number, such astwenty-five, or workflows of the same type are requested. A system inaccordance with one embodiment provides an operational service dashboardwhere a DBA or other authorized operator can evaluate the state of themonitoring process(es), and can manually execute recovery actions. Usingsuch an interface, a DBA can select options that enable kicking offworkflows, as discussed herein, to perform specific recovery actions.The interface can be used with the control plane to work with multipledisparate database engines and systems, even though the control plane isnot in the data path of the data plane. The control plane can monitorerror messages and logs, for example, for each of the engines. Such anapproach also can allow each data store to be monitored as a whole,concurrently monitoring any replicas of the data store. Differentrecovery then can be performed based upon the state of the replicas,etc.

It should be recognized that there can be a variety of types of failuresthat can result in the unavailability or unreliability of a data storeor data instance. For example, a host device might fail or reboot, orthere might be a problem with the host manager application managing theinstance. There also can be a problem with the data store, such as acore dump or segmentation violation (SegV) exception. There also can beproblems with the I/O operations or communication paths, or failure ofthe instance hosting the data store. There also can be various othertypes of failure, such as failure of a logical volume, a network outage,or an data zone failure. Different workflows can be used to attempt todetermine and recover from the different failure types. In one example,the host manager in one embodiment is the gateway to a respective datainstance, and failure of this host manager essentially allows for nocontrol over that instance. To address failures such as a Tomcat processrunning out of memory, a monitoring component of the control plane canensure that Tomcat is restarted if necessary. The monitoring system cancoordinate restarts to avoid unnecessary error or error detection.

Further, as discussed it is not enough to simply detect and recover froma failure, as other factors must be considered, such as the size orscale of the failure. For instance, the recovery action for the failureof a single cloud instance hosting a data store can be substantiallydifferent from a recovery action addressing the failure of an entiredata zone. For larger problems, the multiple failures may need to becorrelated and analyzed such that the recovery actions do not compoundthe existing problems by trying to concurrently recover the variousinstances individually. In some cases, it might be desirable to performa staged recovery, where not only are the number of concurrent processeslimited, but the ordering of the processes can be controlled such thatno data is lost and no recovery actions are taken that later will needto be corrected due to subsequent recovery actions. It also can bedesirable in some cases to localize the recovery process as much aspossible. It can be beneficial in at least some embodiments to address afailure locally in a safe manner, when possible. For instance, localrecovery actions for simple failures such as failure of a host manageror a data process can be preferred to an action performed by an Adminstack of the overall RDS system.

There also can be various reasons for a data instance, data store, orI/O process to fail, each of which might require a different recoveryaction. For example, a data store bug can cause the data store to fail,or at least generate a significant number of read/write errors. A datastore or instance also can fail due to overloads, bad blocks, or othersuch situations. There also can be user-induced errors, such as animproper query that results in crashing the data store. In other cases,a data store log volume might be filled or corrupted. To address theseand other types of failure, the data processes can be constantlymonitored by from host manager. As discussed, each host manager can havea status monitoring component that checks the status of data store orinstance, such as by running a get status command (e.g., for MySQL thiscan take the form of /bin/mysql_admin status). The status monitoringcomponent can periodically check the status, and if an instance isunavailable then the instance can be restarted or otherwise addressed.If an instance repeatedly becomes unavailable, or experiences other sucherrors, the status monitoring component can stop attempting to correctthe error and cause the information to be written to a monitoring oradmin data store in the control plane.

To detect data store errors and I/O crashes, the data store error logand/or kernel log can be monitored in some embodiments. Each hostmanager can run another module that continually scans for certain errortypes in these two (or other) error logs, and generates the relatedmetrics. For each error type, a pre-defined threshold can be set, beyondwhich the errors will be sent to an operator for analysis and possiblerecovery.

A failure detection mechanism in accordance with one embodiment has anumber of constraints applied. For example, it can be configured thatthe monitoring components scale linearly, such that when the number ofdata instances exceeds the number of hosts a bucket of event processorsare set to poll, for example, additional monitoring components cansimply be added as desired. Further, it can be established that all datainstances are to be monitored constantly, such as by partitioning thedata instances and assigning the monitoring ownership of each partitionto one of the event processors. As discussed, if an event processorfails for any reason, the partitions owned and monitored by the failedevent processor can be redistributed evenly to other available eventprocessors, such as processors in the same bucket. Also, a list ofdatabase instances can be kept up-to-date by adding tasks to workflowsas RDS customers create and delete data stores and/or instances.

Data Store Partitioning

As is well known in highly-scalable distributed systems, partitioningwithin a data store only scales to the limits of the physical system inwhich the data store system resides. Due to this limitation, it can bedesirable up front to structure the system in such a way that the systemcan scale both within a single data storage system, as well as acrossmany data storage systems. Horizontal partitioning of data acrossdistinct data storage systems can contribute to a highly-scalable systemwhich can handle significant demands on the event storage.

A system in accordance with one embodiment utilizes a customer_id as thepartition key to partition the data tables, including the list ofdatabase instances (db_poll_list), the related events (db_events table),and the security group events table. It can be advantageous to use acustomer identifier over a data store identifier, as some events are notrestricted to a single data store and may not even concern a particulardata store. For instance, a change in a security group does not directlyapply to any data store, but may need to be stored as a customer visibleevent (i.e., retrievable using a DescribeEvents API). Further, a singlecustomer's events may not grow beyond the storage space of a single datastore, as in some embodiments event data is only retained for a limitedperiod of time, such as for fourteen days.

There are a number of ways to handle partitioning of data sets acrosshorizontal data store partitions, such as by using bucket partitioning.Bucket partitioning provides an abstraction layer between the data beingpartitioned and the partitions where the data is being stored. Thisabstraction layer allows for easier operational management ofpartitions, such as the addition of new partitions with a migration ofdata over time, while still allowing for the application to use ahashing mechanism for determining the placement of partitioned data. Theimplementation of the bucket partition system as described hereincomprises components that are specific to certain embodiments, but theoverall concept is applicable to many different use cases as should beapparent.

To implement bucket partitioning, a fixed number of buckets can bedetermined which are to be available to an application. The number ofbuckets can remain fixed over the life of the application, such thatchoosing a large enough number can be important in certain embodiments.The number of buckets can reflect an ability to evenly distribute loadacross all buckets, which can be individually assigned to a smallernumber of physical partitions. If there are too many individualinstances assigned to the same bucket, then it can become problematic toefficiently store multiple buckets in a single partition. The fixednumber of buckets can act as a middle layer between the data to bepartitioned and the partitions themselves. A first step in the layeringis figuring out how different pieces of data map to the various buckets.As mentioned above, the partition key for the data can be the customeridentifier. An efficient and consistent hashing algorithm can be used toprovide a value that can be assigned directly to an individual bucket.Whenever a customer identifier hashes to a value assigned to a bucket,that identifier can live in that bucket for the lifetime of the data.

In this example, buckets are assigned to individual workload partitions.There can always be more buckets than partitions, so a mapping can beused to assign many different buckets to individual partitions. To makethe assignment configuration concise, ranges of the bucket numbers canbe used to assign the buckets to individual partitions. The followingillustrates an example table showing how the partitioning assignment canwork:

Partition 1={1-25000}

Partition 2={25001-50000}

In this example, bucket numbers 1 through 25,000 are assigned to“Partition 1” while bucket numbers 25,001 through 50,000 are assigned to“Partition 2.” Whenever data needs to be added to the system and thehash of the customer identifier maps the workflow instance to bucket100, for example, any data related to that customer (including datastores and security groups) can be inserted into tables which physicallylive in “Partition 1.” Such an approach also can be used to read anyinformation regarding a customer's database or security groups, where arequest for the events for a given customer whose identifier hashes tobucket 100 will be read from “Partition 1”.

The above example deals with a relatively simple case, with the initialassignment of buckets to partitions being unchanged. Sometimes, however,a new partition will need to be added to the system to alleviate theburden on the other partitions. Using this example above, a newpartition “Partition 3” can be added to take load off of the other twopartitions:

Partition 1={1-16666}

Partition 2={33333-50000}

Partition 3={16667-33333}

As can be seem, 8334 buckets (numbers 16667 through 25000) have beentaken from “Partition 1” and re-assigned to “Partition 3.” Also, 8333additional buckets (numbers 25001 through 33333) have been taken from“Partition 2” and reassigned to “Partition 3.” This reassignment couldhave been based on the buckets which were most busy or most full, but inthis example there was a relatively even redistribution of bucketsacross partitions.

As the bucket assignment changes, the data residing in the physicalpartition can be affected. In an example above, bucket 100 was used tostore the information for a customer whose identifier hashed to 100. Inthis repartitioning scenario, the data would not be affected sincebucket 100 stayed on “Partition 1.” There may have been data in bucket11000, however, and any data written prior to the repartitioning livesin “Partition 1”, but any data written after the repartitioning willexist in “Partition 3”. To resolve this issue with previous dataexisting in one partition and current data existing in anotherpartition, the system can allow for more than one partition to beassigned to a bucket. A given bucket can have at least two partitions, acurrent partition and a previous partition. In the present example, therepartitioning would result in buckets 10001 through 15000 having twopartitions assigned, with “Partition 3” as the current partition, and“Partition 1” as the previous partition. As mentioned, any new data forbucket 11000 will be in the current partition, while any data writtenprior to repartitioning will be in the previous partition. When a queryfor events or any information maps to bucket 11000, it can be importantto check the current partition for that data, as well as to check theprevious partition since the record could exist there as well. Suchsupport for multiple partition lookups in a bucket can incur thepotential cost of misses for those instances which end up in theprevious partition for a given bucket. Since any newly created eventsare being written to the current partition, however, the cost of a misswill only be incurred for workflow instances running when therepartitioning happens or for closed workflows. Favoring newly createdevents can improve performance while still allowing the flexibility todo repartitioning efficiently.

As discussed above, the various embodiments can be implemented in a widevariety of operating environments, which in some cases can include oneor more user computers, computing devices, or processing devices whichcan be used to operate any of a number of applications. User or clientdevices can include any of a number of general purpose personalcomputers, such as desktop or laptop computers running a standardoperating system, as well as cellular, wireless, and handheld devicesrunning mobile software and capable of supporting a number of networkingand messaging protocols. Such a system also can include a number ofworkstations running any of a variety of commercially-availableoperating systems and other known applications for purposes such asdevelopment and database management. These devices also can includeother electronic devices, such as dummy terminals, thin-clients, gamingsystems, and other devices capable of communicating via a network.

Various aspects also can be implemented as part of at least one serviceor Web service, such as may be part of a service-oriented architecture.Services such as Web services can communicate using any appropriate typeof messaging, such as by using messages in extensible markup language(XML) format and exchanged using an appropriate protocol such as SOAP(derived from the “Simple Object Access Protocol”). Processes providedor executed by such services can be written in any appropriate language,such as the Web Services Description Language (WSDL). Using a languagesuch as WSDL allows for functionality such as the automated generationof client-side code in various SOAP frameworks.

Most embodiments utilize at least one network that would be familiar tothose skilled in the art for supporting communications using any of avariety of commercially-available protocols, such as TCP/IP, OSI, FTP,UPnP, NFS, CIFS, and AppleTalk. The network can be, for example, a localarea network, a wide-area network, a virtual private network, theInternet, an intranet, an extranet, a public switched telephone network,an infrared network, a wireless network, and any combination thereof.

In embodiments utilizing a Web server, the Web server can run any of avariety of server or mid-tier applications, including HTTP servers, FTPservers, CGI servers, data servers, Java servers, and businessapplication servers. The server(s) also may be capable of executingprograms or scripts in response requests from user devices, such as byexecuting one or more Web applications that may be implemented as one ormore scripts or programs written in any programming language, such asJava®, C, C # or C++, or any scripting language, such as Perl, Python,or TCL, as well as combinations thereof. The server(s) may also includedatabase servers, including without limitation those commerciallyavailable from Oracle®, Microsoft®, Sybase®, and IBM®.

The environment can include a variety of data stores and other memoryand storage media as discussed above. These can reside in a variety oflocations, such as on a storage medium local to (and/or resident in) oneor more of the computers or remote from any or all of the computersacross the network. In a particular set of embodiments, the informationmay reside in a storage-area network (“SAN”) familiar to those skilledin the art. Similarly, any necessary files for performing the functionsattributed to the computers, servers, or other network devices may bestored locally and/or remotely, as appropriate. Where a system includescomputerized devices, each such device can include hardware elementsthat may be electrically coupled via a bus, the elements including, forexample, at least one central processing unit (CPU), at least one inputdevice (e.g., a mouse, keyboard, controller, touch screen, or keypad),and at least one output device (e.g., a display device, printer, orspeaker). Such a system may also include one or more storage devices,such as disk drives, optical storage devices, and solid-state storagedevices such as random access memory (“RAM”) or read-only memory(“ROM”), as well as removable media devices, memory cards, flash cards,etc.

Such devices also can include a computer-readable storage media reader,a communications device (e.g., a modem, a network card (wireless orwired), an infrared communication device, etc.), and working memory asdescribed above. The computer-readable storage media reader can beconnected with, or configured to receive, a computer-readable storagemedium, representing remote, local, fixed, and/or removable storagedevices as well as storage media for temporarily and/or more permanentlycontaining, storing, transmitting, and retrieving computer-readableinformation. The system and various devices also typically will includea number of software applications, modules, services, or other elementslocated within at least one working memory device, including anoperating system and application programs, such as a client applicationor Web browser. It should be appreciated that alternate embodiments mayhave numerous variations from that described above. For example,customized hardware might also be used and/or particular elements mightbe implemented in hardware, software (including portable software, suchas applets), or both. Further, connection to other computing devicessuch as network input/output devices may be employed.

Storage media and computer readable media for containing code, orportions of code, can include any appropriate media known or used in theart, including storage media and communication media, such as but notlimited to volatile and non-volatile, removable and non-removable mediaimplemented in any method or technology for storage and/or transmissionof information such as computer readable instructions, data structures,program modules, or other data, including RAM, ROM, EEPROM, flash memoryor other memory technology, CD-ROM, digital versatile disk (DVD) orother optical storage, magnetic cassettes, magnetic tape, magnetic diskstorage or other magnetic storage devices, or any other medium which canbe used to store the desired information and which can be accessed bythe a system device. Based on the disclosure and teachings providedherein, a person of ordinary skill in the art will appreciate other waysand/or methods to implement the various embodiments.

The specification and drawings are, accordingly, to be regarded in anillustrative rather than a restrictive sense. It will, however, beevident that various modifications and changes may be made thereuntowithout departing from the broader spirit and scope of the invention asset forth in the claims.

What is claimed is:
 1. A system, comprising: a plurality of computingnodes, respectively comprising at least one processor and a memory thattogether implement a control plane for a data store, the control planeconfigured to: store data generation information, that identifies aparticular generation of replicated data, for each of a primary instancereplica and a secondary instance replica, wherein the primary instancereplica sends data to the secondary instance replica over a connectionbetween the primary instance replica and the secondary instance replicato perform data replication; monitor communication over the connectionbetween the primary instance replica and the secondary instance replicaand connections between the control plane and the primary instancereplica and the control plane and the secondary instance replica; andperform a type of recovery process responsive to detecting a loss ofcommunication, wherein the type of recovery process is determined basedat least in part on the connection over which the loss of communicationoccurred and respective data generation information, that identifiesrespective generations of the replicated data, for the primary instancereplica and the secondary instance replica.
 2. The system of claim 1,wherein the loss of communication comprises: a failure to respond to arequest for status from the control plane by the primary instancereplica or the secondary instance replica; or receipt of an indicationof a loss of communication between the primary instance replica and thesecondary instance replica from the primary instance replica or thesecondary instance replica.
 3. The system of claim 1, wherein the lossof communication is on the connection between the control plane and theprimary instance replica; wherein a further loss of communication isdetected on the connection between the secondary instance replica andthe primary instance replica; wherein the control plane is furtherconfigured to determine that the data generation information for theprimary instance replica and the secondary instance replica match; andwherein the particular type of recovery process is a failover operationto promote the secondary instance replica to operate as a new primaryinstance replica.
 4. The system of claim 1, wherein the loss ofcommunication is on the connection between the control plane and thesecondary instance replica, wherein a further loss of communication isdetected on the connection between the primary instance replica and thesecondary instance replica, and wherein the particular type of recoveryprocess is a secondary instance recovery process.
 5. The system of claim1, wherein the control plane is further configured to: store, in acontrol plane data store, recovery information comprising the datageneration information for each of the primary instance replica and thesecondary instance replica and the detected loss of communication; andaccess the recovery information in the control plane data store togenerate a workflow to be executed, wherein the particular failoveroperation or recovery process is performed as part of executing thegenerated workflow.
 6. The system of claim 1, wherein a component of thecontrol plane configured to monitor the communication over theconnections is located in a data zone different than either the primaryinstance replica or the secondary instance replica.
 7. The system ofclaim 1, wherein the control plane comprises a plurality of monitoringcomponents to monitor a plurality of primary and secondary instancereplicas including the primary instance replica and the secondaryinstance replica, wherein a first monitoring component is configured toobtain a lease to monitor the primary instance replica and the secondaryinstance replica that excludes other ones of the plurality of monitoringcomponents from monitoring the primary instance replica and thesecondary instance replica.
 8. A method, comprising: performing, by oneor more computers, obtaining, by a monitoring component, data generationinformation, that identifies respective generations of replicated data,for each of a primary instance replica and a secondary instance replica,wherein the primary instance replica sends data to the secondaryinstance replica over a connection between the primary instance replicaand the secondary instance replica to perform data replication;monitoring communication over connections between the monitoringcomponent and the primary instance replica, the monitoring component andthe secondary instance replica, and the primary instance replica and thesecondary instance replica; and performing a type of recovery processresponsive to a loss of communication detected by the monitoringcomponent, wherein the type of recovery process is determined based atleast in part on the connection over which the loss of communicationoccurred and the respective data generation information, that identifiesthe respective generations of the replicated data, for the primaryinstance replica and the secondary instance replica.
 9. The method ofclaim 8, wherein the loss of communication detected by the monitoringcomponent comprises: a failure to respond to a request for status fromthe monitoring component by the primary instance replica or thesecondary instance replica; or receipt, by the monitoring component, ofan indication of a loss of communication between the primary instancereplica and the secondary instance replica from the primary instancereplica or the secondary instance replica.
 10. The method of claim 8,wherein the loss of communication is on the connection between themonitoring component and the primary instance replica; wherein a furtherloss of communication is detected on the connection between thesecondary instance replica and the primary instance replica; wherein themethod further comprises determining that the data generationinformation for the primary instance replica and the secondary instancereplica match; and wherein the particular type of recovery process is afailover operation to promote the secondary instance replica to operateas a new primary instance replica.
 11. The method of claim 8, whereinthe loss of communication is on the connection between the monitoringcomponent and the secondary instance replica, wherein a further loss ofcommunication is detected on the connection between the primary instancereplica and the secondary instance replica, and wherein the particulartype of recovery process is a secondary instance recovery process. 12.The method of claim 8, further comprising: storing, by the monitoringcomponent, recovery information comprising the data generationinformation for each of the primary instance replica and the secondaryinstance replica and the detected loss of communication in a controlplane data store; and accessing the recovery information in the controlplane data store to generate a workflow to be executed, wherein theparticular failover operation or recovery process is performed as partof executing the generated workflow.
 13. The method of claim 8, whereinthe monitoring component is located in a data zone different than eitherthe primary instance replica or the secondary instance replica.
 14. Themethod of claim 8, wherein the monitoring component is one of aplurality of monitoring components implemented as part of a controlplane that monitors a plurality of primary and secondary instancereplicas including the primary instance replica and the secondaryinstance replica, wherein prior to obtaining the data generationinformation for the primary instance replica and the secondary instancereplica, the monitoring component obtains a lease to monitor the primaryinstance replica and the secondary instance replica that excludes otherones of the plurality of monitoring components from monitoring theprimary instance replica and the secondary instance replica.
 15. Anon-transitory, computer-readable storage medium, comprising programinstructions that when executed by one or more computing devices causethe one or more computing devices to implement: obtaining, by amonitoring component, data generation information, that identifiesrespective generations of replicated data, for each of a primaryinstance replica and a secondary instance replica, wherein the primaryinstance replica sends data to the secondary instance replica over aconnection between the primary instance replica and the secondaryinstance replica to perform data replication; monitoring communicationover connections between the monitoring component and the primaryinstance replica, the monitoring component and the secondary instancereplica, and the primary instance replica and the secondary instancereplica; and performing a type of recovery process responsive to a lossof communication detected by the monitoring component, wherein the typeof recovery process is determined based at least in part on theconnection over which the loss of communication occurred and therespective data generation information, that identifies the respectivegenerations of the replicated data, for the primary instance replica andthe secondary instance replica.
 16. The non-transitory,computer-readable storage medium of claim 15, wherein the loss ofcommunication detected by the monitoring component comprises: a failureto respond to a request for status from the monitoring component by theprimary instance replica or the secondary instance replica; or receipt,by the monitoring component, of an indication of a loss of communicationbetween the primary instance replica and the secondary instance replicafrom the primary instance replica or the secondary instance replica. 17.The non-transitory, computer-readable storage medium of claim 15,wherein the loss of communication is on the connection between themonitoring component and the primary instance replica; wherein a furtherloss of communication is detected on the connection between thesecondary instance replica and the primary instance replica; wherein theprogram instructions further cause the one or more computing devices toimplement: determining that the data generation information for theprimary instance replica and the secondary instance replica match; andwherein the particular type of recovery process is a failover operationto promote the secondary instance replica to operate as a new primaryinstance replica.
 18. The non-transitory, computer-readable storagemedium of claim 15, wherein the loss of communication is on theconnection between the monitoring component and the secondary instancereplica, wherein a further loss of communication is detected on theconnection between the primary instance replica and the secondaryinstance replica, and wherein the particular type of recovery process isa secondary instance recovery process.
 19. The non-transitory,computer-readable storage medium of claim 15, wherein the programinstructions cause the one or more computing devices to implement:storing, by the monitoring component, recovery information comprisingthe data generation information for each of the primary instance replicaand the secondary instance replica and the detected loss ofcommunication in a control plane data store; and accessing the recoveryinformation in the control plane data store to generate a workflow to beexecuted, wherein the particular failover operation or recovery processis performed as part of executing the generated workflow.
 20. Thenon-transitory, computer-readable storage medium of claim 15, whereinthe monitoring component is located in a data zone different than eitherthe primary instance replica or the secondary instance replica.